HEROIC Researchers Link cpanelDMZ Leak to 224 Hosting Logins

HEROIC researchers identified a combolist file named cpanelDMZ uploaded to a Telegram channel in March 2026. The name points to cPanel, the web hosting control panel software used to manage websites, email accounts, and databases. The file contains 224 records pairing email addresses with plaintext passwords and the URLs those logins are tied to. Why This Is Dangerous: cPanel accounts are administrative access points, not just single website logins. Someone with a working cPanel credential can potentially manage every website, email inbox, and database tied to that hosting account. Because the passwords here are stored in plaintext, an attacker can try each one immediately with no cracking involved. What Was Exposed: - Email addresses - Plaintext passwords - URLs tied to the hosting accounts Why This Matters: If even a handful of these 224 credentials still work, an attacker could deface websites, redirect visitors to malicious pages, read or export email hosted on that account, or use the server as a base for further phishing and malware campaigns. Because hosting accounts often sit behind a single login for many services at once, this kind of leak can cause damage far beyond one person's inbox or one company's website. How a Combolist Like This Works: A combolist pairs usernames or emails with passwords, usually gathered from smaller breaches, phishing pages, or stealer logs and organized around a theme, in this case hosting panel logins. Attackers upload these files to Telegram to trade or sell them, then run each pair against the real cPanel login page to confirm which credentials are still active before using or reselling the verified list. Check If You Are Affected: Run a free scan against HEROIC's database of more than 400 billion breached records to see if your email address appears in this leak or any other. If you manage a hosting account, change your cPanel password immediately, avoid reusing it elsewhere, and review your account for any unauthorized changes.