How the ‘es test’ Combolist Leaked 1,997 Records on Telegram

In January 2026, HEROIC analysts uncovered a combolist file named "es test" being shared on Telegram. Here's how it happened: a user compiled 1,997 records, pairing email addresses with plaintext passwords and associated URLs, and uploaded the file for other Telegram users to access.

Why This Is Dangerous

Because each password in this file is stored in plaintext, it can be read and reused the moment someone downloads it, no cracking or extra tools required. Pairing each credential with a specific URL means an attacker knows exactly which login page to target first, cutting out the guesswork.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs/login destinations

Why This Matters

Once a file like this is uploaded and shared, it spreads quickly across other channels and forums, multiplying the number of people who can attempt to use it. If any of the 1,997 exposed passwords were reused elsewhere, criminals can use credential stuffing tools to try them against banking, email, and social media platforms, leading to account takeover, financial fraud, or identity theft.

How Combolist Leaks Work

A combolist is typically built by combining login credentials from several earlier breaches or stealer infections into one formatted file, rather than coming from a single hacked company. The "test" naming here suggests this file may have been an early or sample release, a pattern common among Telegram accounts that compile and distribute credential data.

Check If You Are Affected

Rather than guess whether your credentials made it into a file like this one, check directly. HEROIC's free breach scanner searches more than 400 billion leaked records, including this 1,997-record combolist, so you can confirm your exposure in seconds and take action if needed.