Croatia Corp Mail Sample Exposes 1,075 Email and Password Pairs

HEROIC analysts identified a combolist labeled for Croatia corporate email accounts, uploaded to a Telegram channel on 22 February 2026. The file contains 1,075 records, each pairing an email address with a plaintext password and a URL tied to the account's login page. This regional grouping matters because it tells us the leak was assembled around a specific set of Croatia-linked mail accounts rather than scraped at random.

Why the Croatia Focus of This Leak Matters

When a combolist is organized around a specific country or region, it usually means the accounts share something in common, in this case a Croatia corporate mail domain grouping. That focus makes the list more valuable to attackers, since it lets them target a known population rather than sorting through unrelated records, and it means everyone in this file shares the same exposure regardless of which specific organization they work for.

What Was Exposed

• Email addresses tied to Croatia corporate mail accounts
• Plaintext passwords, readable and usable without cracking
• URLs identifying the login destination for each credential pair
• 1,075 total records in the file

Why This Matters

Plaintext passwords collected into a regional list like this one are prime material for credential stuffing campaigns, where attackers try each pair against multiple services. Anyone in this file who reused their password elsewhere faces a real risk of account takeover, and from there, identity theft or financial fraud if personal or payment details are reachable through the compromised account.

How Combolist Breaches Work

A combolist is a file of email and password pairs gathered from various sources and organized for easy reuse, often grouped by domain, country, or industry to make the data more useful to whoever buys or trades it. That is exactly the pattern seen here, a Croatia-labeled set of corporate mail credentials packaged into one combolist and shared on Telegram.

Check If You Are Affected

If you hold a Croatia corporate email account, it is worth checking whether your credentials are part of this leak. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can confirm your exposure and secure any account still using the leaked password.