HEROIC Analysts Found hertzheroes.ch Passwords on Telegram

HEROIC Analysts Found a hertzheroes.ch Combolist Circulating on Telegram

On 20 August 2023, HEROIC analysts identified a combolist labeled "hertzheroes.ch_5.044_crypt," uploaded to Telegram by an individual user. The file name ties the data to hertzheroes.ch, and the credentials inside are stored as plaintext passwords, meaning they are already fully readable. The list contained 2,570 records, each pairing an email address with a plaintext password and the URL of the login page those credentials were meant to access.

Why This Is Dangerous

Because these passwords are stored in plaintext, there is no encryption for an attacker to break. Anyone who obtains this file can read a person's exact password next to their exact email address and the exact site it works on. For the 2,570 people in this list, that means an attacker could attempt a direct login the moment they open the file.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

Even a smaller combolist like this one is dangerous because of password reuse. Attackers run these email and password pairs through automated credential stuffing tools that test the same combination against email providers, banks, and shopping accounts. Anyone who reused this password elsewhere is at risk of account takeover, which can quickly lead to identity theft or financial fraud.

How a hertzheroes.ch Combolist Like This Circulates

Combolists like this one are compiled from a site's user records or from data gathered through smaller, less publicized breaches, then formatted as email, password, and URL for easy use. Because the passwords are already plaintext, no additional cracking is required before the file is ready. Files like this are shared and traded in private Telegram channels dedicated to buying, selling, and swapping stolen credentials.

Check If You Are Affected

If you have ever used hertzheroes.ch or reused a password across sites, take a moment to check your exposure. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including combolists like this one, so you know immediately whether it is time to change your passwords.