The Fraser.sfu.ca Leak Put University Logins for 5,684 Users Online

The Fraser.sfu.ca Combolist Exposes 5,684 University Logins HEROIC analysts identified a combolist referencing "fraser.sfu.ca," a Simon Fraser University email domain, uploaded to Telegram on June 10, 2026. The file contains 5,684 records pairing email addresses with plaintext passwords and associated URLs. Why This Is Dangerous University accounts often connect to student records, financial aid systems, library access, and email that students and staff use for years. With passwords stored in plaintext, attackers can log straight into any of these systems without needing to crack anything. What Was Exposed Email addressesPlaintext passwordsAssociated URLs Why This Matters Students and staff frequently reuse their university password for personal email, banking, or shopping accounts. If any of the 5,684 people in this list did the same, attackers could use these credentials for account takeover, financial fraud, or identity theft well beyond the university system itself. How a Combolist Works A combolist gathers login pairs, an email or username matched with a password, from earlier breaches or malware infections into one organized file. Criminals distribute these lists on Telegram because they can be fed directly into automated tools that test each pair against many websites at once. Check If You Are Affected If you have an SFU email address or think your credentials might be exposed elsewhere, HEROIC's free breach scanner checks against a database of more than 400 billion leaked records. Run a free scan and change your password if it turns up.