HestiaCP Vulnerability Combolist Leak Exposes 23 U.S. Logins

HestiaCP Combolist: 23 U.S. Records Exposed

In June 2026, HEROIC analysts identified a small combolist labeled "Vuln_HestiaCP," uploaded to a Telegram channel by an anonymous user. The file contained 23 records pairing email addresses with plaintext passwords, along with the URLs of the accounts involved. The listing's country data points to United States-based accounts, and its naming suggests it was gathered by targeting sites running HestiaCP, an open-source web hosting control panel.

Why This Is Dangerous

Although the number of records is small, control panel logins like these carry outsized risk. HestiaCP is used to manage entire web servers, meaning a compromised account here could give an attacker access to websites, email accounts, and other services hosted on that server, not just a single login. Because the passwords are stored in plaintext, anyone who obtains the file can attempt to log in immediately, with no cracking required.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated accounts

Why This Matters

Even a small leak like this one feeds directly into credential stuffing attacks, where automated tools try each email and password pair against other websites and services. If any of these 23 people reused their password elsewhere, whether for email, banking, or other hosted services, that reuse gives an attacker an easy path to account takeover or further compromise. Server management credentials are especially valuable because they can expose everything else running on that machine.

How a Combolist Attack Works

A combolist is a compiled file of email or username and password pairs, often collected from targeted scans, malware, or previous leaks and organized around a specific theme, in this case, accounts tied to HestiaCP. Criminals share these lists on platforms like Telegram, where others download them and run the credentials through automated login tools. Because the passwords in this list were never hashed or encrypted, they are usable the instant the file is shared, regardless of how few records it contains.

Check If You Are Affected

If you manage a server using HestiaCP or have an account that might be tied to this leak, it is worth checking your exposure now. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records and will tell you instantly if you show up. If you find a match, change your password right away and avoid reusing it across any other accounts or services.