One Telegram Upload, 19,827 Records: The eatel1.net Email Leak

HEROIC analysts spotted a combolist labeled "eatel1.net" posted to a Telegram channel on 10-Jun-2026. The file contains 19,827 records, each pairing an email address with a plaintext password, along with URLs linking the credentials back to the accounts they came from.

Why This Is Dangerous

With nearly 20,000 entries, this list is large enough for an attacker to automate testing every email and password pair against other websites within a short time. Because the passwords are stored in plaintext rather than hashed or encrypted, they can be used immediately, with no cracking tools or technical effort required.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

A combolist of this size gives criminals real scale to run credential stuffing attacks, feeding all 19,827 pairs into automated tools that try each login across banking, email, and shopping sites. Anyone whose password shows up here and was reused elsewhere faces a real risk of account takeover, and once one account is compromised, attackers often use it to unlock others, leading to financial fraud or identity theft.

How This Combolist Was Assembled

Combolists like this one are usually put together from data pulled out of older breaches, phishing pages, or malware that harvests saved logins from infected devices, then compiled into a single text file. Whoever assembled this one is not necessarily the original source of the breach, they may have gathered and repackaged credentials from multiple leaks before sharing the finished file through Telegram.

Check If You Are Affected

The quickest way to find out if your email address is part of this leak, or any other breach HEROIC has cataloged, is to run it through HEROIC's free breach scanner. It checks your information against a database of more than 400 billion exposed records in seconds. If you get a match, change that password everywhere else you have used it.