The hestiacp_wrtcloud Leak Exposed 7 Working Hosting Panel Logins

In February 2026, HEROIC analysts flagged a small file named "hestiacp_wrtcloud" shared in a Telegram channel used to trade stolen credentials. Unlike a typical personal email combolist, the file's name points to HestiaCP, an open-source web hosting control panel, meaning the 7 records inside appear to be login credentials for hosting control panel accounts rather than personal webmail. Each record pairs a username or email address with a plaintext password and a related URL.

Why This Is Dangerous

A hosting control panel typically manages everything running on a web server, including websites, email accounts, databases, and DNS settings. If any of these 7 credentials are still active, whoever holds this file could log into a hosting panel directly and gain control over every site and service tied to that account, not just a single inbox.

What Was Exposed

• Usernames and email addresses
• Plaintext passwords
• URLs tied to each set of credentials

Why This Matters

Only 7 records appear in this file, but hosting control panel access is a high-value target regardless of scale, because a single compromised panel can expose every website hosted under that account. Attackers who obtain working panel credentials can plant malware on hosted sites, redirect visitor traffic, pull data from every site on the server, or lock the legitimate owner out entirely. That makes this a different and often more serious risk than an ordinary personal email and password leak.

How Control Panel Credentials End Up in Files Like This

Hosting control panel logins are usually harvested the same way personal credentials are: through phishing pages built to mimic the panel's login screen, malware installed on an administrator's computer that silently logs saved passwords, or simple password reuse across personal and hosting accounts. Once obtained, these credentials get bundled with other stolen data and traded on Telegram and dark web forums, often mixed in with unrelated combolists like the ones seen elsewhere in this batch.

Check If You Are Affected

If you manage a website or hosting account, especially one running HestiaCP or a similar control panel, check whether your admin email appears in a known breach. Run a free scan with HEROIC's breach checker, which searches more than 400 billion leaked records, and if you find a match, change your hosting panel password immediately and enable two-factor authentication where it's available.