Iran Corp Email Users Targeted: 1,046 Credentials Leaked Online

HEROIC analysts found a combolist of Iran corporate email accounts uploaded to a Telegram channel on 22 February 2026. The file contains 1,046 records, each pairing an email address with a plaintext password and a URL identifying where that login belongs. The people named in this file are not random, they are specifically the holders of corporate mail accounts under this domain grouping, which shapes exactly who is at risk and how.

Who Is Targeted by This Iran Corp Mail Leak

Every record in this file belongs to someone with a corporate email address, meaning the accounts are tied to a workplace rather than a personal inbox. That makes this group a specific target for attackers looking for access to business communications, internal systems, or any service where a work email doubles as the login.

What Was Exposed

• Email addresses belonging to Iran corporate mail account holders
• Plaintext passwords attached to each email address
• URLs marking the login destination for each credential pair
• 1,046 total records contained in the file

Why This Matters

Because the passwords are plaintext, they are immediately usable without any cracking effort. Attackers running credential stuffing campaigns will test these exact email and password pairs against email providers, cloud storage, and other business tools, since corporate account holders often reuse the same password across several of those services. A single successful login can lead to account takeover, and if any personal or financial details are reachable from that account, identity theft and financial fraud follow close behind.

How Combolist Breaches Work

A combolist is a compiled list of email and password pairs gathered from multiple leak sources and repackaged so criminals can use it directly, without further processing. Unlike a breach of a single company, a combolist can bundle together credentials collected over time from different places, which is part of why targeted groups like corporate email holders end up concentrated in one file.

Check If You Are Affected

If you hold an Iran corporate email account, it is worth confirming whether your credentials are part of this leak. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can quickly see your exposure and secure any account still using the leaked password.