Orange.fr Combolist Leak: 2,536 Passwords Exposed in Plaintext

In late October 2025, HEROIC analysts identified a combolist file labeled Orange.fr Test that had been uploaded to a Telegram channel by an unnamed user. The file contained 2,536 records pairing email addresses with plaintext passwords, along with the URLs each credential pair was tied to. Why This Is Dangerous: Because the passwords in this file were stored and shared in plaintext, anyone who downloads it can read the credentials directly, no cracking or decryption required. An attacker can plug these email and password pairs straight into login pages and see what works. What Was Exposed: - Email addresses - Plaintext passwords - URLs linked to each account Why This Matters: Most people reuse the same password across multiple accounts. If your email and password from this list also unlock your banking app, your work account, or your social media, an attacker who tests this combolist against other sites, a technique called credential stuffing, can take over those accounts too. That can lead to account takeover, financial fraud, and identity theft. How a Combolist Like This Works: A combolist is simply a text file pairing usernames or emails with passwords, usually built by combining data from older breaches, stealer malware logs, or manual collection. Criminals trade and upload these lists on Telegram and dark web forums, then use automated tools to test the credentials against banking sites, email providers, and shopping accounts to find working logins. Check If You Are Affected: HEROIC's free breach scanner checks your email address against more than 400 billion leaked records, including combolists like this one. Run a free scan to see if your credentials were exposed and get guidance on securing your accounts.