Search Your Email: GMX.fr Test Leak Exposed 1,000 Records

In January 2026, HEROIC analysts found a combolist file called "GMX.fr test" circulating on Telegram. The file contained 1,000 records, each combining an email address with a plaintext password and an associated URL.

Why This Is Dangerous

Every credential in this file is stored in plaintext, meaning anyone who downloads it can use the email and password combinations immediately, without needing to break any encryption. The paired URLs point directly to the login pages these credentials were intended for, making the file simple to plug into automated attack tools.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs/login destinations

Why This Matters

Search your email against leaks like this one, because reused passwords are exactly what makes combolists dangerous. Once a working email and password pair is confirmed, criminals use it to attempt logins across banking, shopping, and email accounts, which can quickly turn into account takeover, financial fraud, or identity theft, even for people who never used the original service tied to this leak.

How Combolist Leaks Work

A combolist is a plain text file of email and password pairs, often compiled from several older leaks and shared or sold within Telegram channels dedicated to stolen data. The "test" label in this file's name suggests it may have been a smaller sample shared before a larger release, a common pattern among the groups that trade in this kind of data.

Check If You Are Affected

Rather than wait and wonder, search your email directly against HEROIC's database of more than 400 billion leaked records, including this 1,000-record combolist. Our free breach scanner tells you in seconds whether your credentials have been exposed, so you can change any reused passwords before someone else tries them first.