The ‘Mauritius Corp’ Test Sample Quietly Leaked 1,048 Work Emails

In February 2026, HEROIC analysts identified a file titled "MAURITIUS CORP-OTHERS-PRO MAILS TEST SAMPLE" that a Telegram user uploaded, tied to a leak date of February 22, 2026. The file quietly exposed 1,048 records pairing corporate-style email addresses with plaintext passwords and URLs. Why This Is Dangerous: The words "test sample" in the filename suggest this file may be a small preview of a larger corporate mailing list, released to demonstrate the data before a bigger sale or leak. Even as a sample, every one of the 1,048 email and password pairs is fully usable right now, with no cracking required. What Was Exposed: - Corporate-style email addresses - Plaintext passwords tied to those accounts - URLs showing which site or service each credential pair unlocks Why This Matters: When a "sample" of corporate credentials circulates quietly, it often signals a bigger breach behind it that hasn't been fully released yet. If your work email is among these 1,048 records, attackers can use it to attempt account takeover, and because business accounts often connect to internal systems, one compromised login can expose far more than a personal inbox would, including sensitive company data and financial systems. How a Combolist Like This Works: A "sample" combolist is typically a small cut of a larger stolen dataset, shared to prove the data is real before the full set is sold or leaked elsewhere. These test files circulate quietly on Telegram, often overlooked because of their small size, while the larger dataset they came from continues to be sold in private channels. Check If You Are Affected: A quiet, small leak today can be the first sign of a bigger one tomorrow. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, so you can confirm right now whether your work email was part of this sample or any related leak.