HEROIC Analysts Link 11,095 Leaked sfr.fr Logins to Telegram Combolist

HEROIC analysts linked a Telegram combolist to sfr.fr accounts, uploaded on June 12, 2026, and containing 11,095 records of email addresses, plaintext passwords, and account URLs. Why This Is Dangerous: With 11,095 plaintext credential pairs in one file, an attacker has enough volume to automate login attempts across a wide range of accounts, no password cracking needed. The included URLs let them target the exact login pages tied to each record. What Was Exposed: - Email addresses - Plaintext passwords - Account URLs Why This Matters: A leak of this size significantly raises the odds that attackers will find working, reused passwords among the 11,095 accounts. Anyone affected faces a heightened risk of credential stuffing attacks against their email, banking, or shopping accounts if they used the same password more than once. How This Telegram Combolist Works: Combolists like this one are typically built by combining data from several smaller breaches, stealer malware infections, and phishing kits into one large file, then distributed on Telegram for other criminals to use. No encryption protects the data once it is compiled this way. Check If You Are Affected: HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including combolists like this one. Run a free scan to see if your sfr.fr credentials were exposed.