Your Online.de Account May Be Compromised: 1,725 Passwords Leaked

Online.de Combolist: 1,725 Accounts Traced to a Telegram Upload

HEROIC analysts traced a combolist referencing online.de to a Telegram upload from late July 2026. The file contained 1,725 records, each pairing an email address with a plaintext password and the URL the login was captured from.

Why This Is Dangerous

Even a small combolist like this one is dangerous because the passwords are stored in plaintext, meaning anyone who opens the file can read them instantly with no cracking required. Paired with the matching email address and URL, an attacker has everything needed to attempt a direct login to the affected online.de accounts.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

A leak this size is often overlooked by the people affected, but it carries the same risks as a larger breach for anyone caught up in it. Attackers use small, targeted combolists like this one for credential stuffing against other accounts, and if any of these 1,725 people reused their online.de password elsewhere, that single leaked credential could open the door to email, banking, or social media accounts too.

How Combolists Work

A combolist is a plain text file pairing stolen usernames or email addresses with their matching passwords, usually gathered from earlier breaches, phishing pages, or malware and then bundled for resale or free distribution. Smaller combolists like this one are often the byproduct of a targeted phishing campaign or a single compromised source, and once uploaded to Telegram they can be tested against login pages within minutes.

Check If You Are Affected

If you have an online.de account, it is worth checking whether your information appears in this leak. HEROIC's free breach scanner checks your email address against more than 400 billion leaked records, including combolists like this one, so you can find out quickly and change your password before someone else gets the chance to use it.