HEROIC Analysts Found a Verified Dodo.au Mail Access Dump on Telegram

In September 2025, HEROIC analysts discovered a combolist file labeled MAIL ACCESS 200 DODO.AU VALID circulating in a Telegram channel, uploaded by an anonymous user. The file contained 203 records, each pairing an email address with a plaintext password and the login URL it belongs to, all tied to Dodo.au mail accounts.

Why This Small Dodo.au Dump Still Matters

203 records is a small number compared to headline-grabbing mega breaches, but the label "valid" tells its own story: whoever compiled this list confirmed these mail logins still work. For the 203 people affected, that means an attacker already has a working key to their inbox, not a stale password from years ago.

What Was Exposed in This Dodo.au Leak

• Email addresses
• Plaintext passwords
• URLs of the mail accounts those credentials belong to

Why Mail Access Leaks Are Especially Risky

Email accounts are the recovery point for almost everything else online: banking, shopping, and social media all rely on email to reset a forgotten password. If an attacker has verified access to someone's inbox, they can intercept password reset messages and take over other accounts one by one. That turns a leak of just 203 mailboxes into a launchpad for much wider account takeover and identity theft.

How a Verified Mail Access Combolist Gets Made

Lists like this one start as raw email and password pairs pulled from stealer logs or older breaches. The compiler then runs each pair through an automated login checker aimed at a specific mail provider, in this case Dodo.au, and keeps only the confirmed working logins. That smaller, verified file is what ends up being shared or sold in Telegram channels.

Check If You Are Affected

If you use a Dodo.au email account or think your credentials could be part of this leak or any other breach, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. Run a scan now and change your password if it turns up.