One Telegram Upload. 288 Records. The South Korea Combolist Leak.

HEROIC analysts found this file on Telegram on July 17, 2026. A Telegram user uploaded a combolist named South Korea containing 288 records of email addresses and plaintext passwords with associated login URLs. Based on the file name, the list appears to focus on accounts linked to South Korea, though HEROIC has not independently verified every account's location. Why This Is Dangerous: Although this is one of the smaller files HEROIC has reviewed, every one of the 288 entries includes a plaintext password, meaning an attacker can use each login immediately without any additional effort to crack or decode it. What Was Exposed: - Email addresses - Plaintext passwords - Login URLs Why This Matters: A small file doesn't mean small consequences for the people in it. Anyone whose email appears here faces the same risk as victims of much larger breaches: credential stuffing against other accounts, potential account takeover, and identity theft if personal or financial accounts share the same password. How a Regionally Focused Combolist Like This Works: Smaller, regionally labeled combolists like this one are often carved out of a larger stolen data set and filtered by country or language, making them easier to sell to buyers targeting a specific region. The small size suggests this may be a sample or a niche batch rather than the result of one single large-scale breach. Check If You Are Affected: HEROIC's free breach scanner checks your email against more than 400 billion breached and leaked records, regardless of the file's size or origin. Run a free scan to confirm whether your credentials were exposed.