Our Analysts Found the citi.net Combolist Circulating on Telegram

In June 2026, HEROIC analysts identified a combolist labeled "citi.net - 2.545 emails" uploaded to a Telegram channel. The file contained 2,545 records, each pairing an email address with a plaintext password and the URL of the login page it unlocks. The name suggests these credentials were gathered around addresses associated with the citi.net domain, though the underlying accounts affected can vary. Why This Is Dangerous: Every one of these 2,545 passwords is stored in plain text, so there is no encryption protecting the data once it leaves the file. Each entry is paired with the exact login URL, meaning an attacker can move straight from opening the file to attempting a login, with no extra research required. What Was Exposed: - Email addresses - Plaintext passwords - URLs for the associated login pages Why This Matters: If any of the 2,545 people in this file reused their password on other accounts, attackers can use this list to attempt logins across banking, shopping, and social media platforms through credential stuffing. Because the passwords are plaintext, there is nothing slowing down anyone who wants to try them. How Combolists Work: A combolist is a merged file of email or username and password pairs, typically assembled from older breaches, stealer logs, or earlier leaks tied to a shared theme, in this case a specific email domain. These themed lists make it easier for buyers to target a particular group of users, and are commonly shared or sold on Telegram channels and dark web forums. Check If You Are Affected: If you have an email address tied to citi.net or a similar domain, it is worth checking whether your credentials appear in this file. HEROIC's free breach scanner searches a database of more than 400 billion breached records, including combolists like this one, so you can find out quickly and update your password if needed.