The culture.gouv.fr Leak: 986 Government Emails Exposed

HEROIC analysts found a combolist tied to culture.gouv.fr, the domain used by France's Ministry of Culture, posted to Telegram on 10-Jun-2026. The file contains 986 records, each pairing an email address with a plaintext password, along with URLs linking the credentials back to the accounts they came from.

Why This Is Dangerous

Government domain credentials carry more weight than typical consumer accounts because they can be used to impersonate officials, access internal systems, or serve as a foothold for further attacks against a government network. Because the passwords in this file are stored in plaintext, anyone who obtains the list can attempt to log in immediately, without needing to crack anything.

What Was Exposed

• Email addresses (culture.gouv.fr)
• Plaintext passwords
• Associated URLs

Why This Matters

A leak of 986 government email and password pairs raises the stakes well beyond ordinary credential stuffing. If any of these accounts were reused elsewhere, or if the same login grants access to internal government systems, attackers could use them for account takeover, phishing campaigns that appear to come from an official source, or as a stepping stone toward more serious espionage-style intrusions. Even outside government use, individuals whose passwords appear here face the same personal risk of financial fraud and identity theft as any other credential leak.

How This Combolist Was Assembled

Combolists tied to a specific domain, like this one, are often built by scraping login pages, phishing government employees directly, or pulling data from earlier breaches that happened to include government email addresses. The credentials are then filtered by domain and packaged into a smaller, more targeted file, which is more valuable to buyers than an unsorted mix because it lets them focus their attacks on one organization.

Check If You Are Affected

If you have a culture.gouv.fr email address or any account you suspect may be affected, it is worth checking against HEROIC's records. HEROIC's free breach scanner searches a database of more than 400 billion exposed records in seconds. If you find a match, change that password immediately and report the exposure to your IT or security team.