If You Use a McGill Email, the po-box.mcgill.ca Leak Involves You

HEROIC analysts found a combolist titled "po-box.mcgill.ca - 1,901 emails" uploaded to Telegram on June 10, 2026. The file contains 1,901 records specifically targeting po-box.mcgill.ca addresses, associated with McGill University, paired with plaintext passwords and related URLs. Why This Is Dangerous: Because this list is filtered to a single email domain, it's more useful to an attacker than a generic combolist. Anyone targeting McGill students, faculty, or staff now has 1,901 ready-made login attempts, all with passwords stored in plaintext and no encryption to work around. What Was Exposed: Every record in the po-box.mcgill.ca file contains the same three fields. - po-box.mcgill.ca email addresses - Plaintext passwords - URLs associated with the accounts Why This Matters: University email accounts often connect to student portals, financial aid systems, library access, and personal cloud storage. If a password from this leak was reused on a banking or shopping site, that account is exposed too. Attackers frequently target university domains specifically because of how many downstream systems a single login can unlock, which is exactly how credential stuffing and account takeover start. How a Combolist Like This Works: A domain-specific combolist is built by filtering a larger collection of leaked credentials down to addresses from one organization. Attackers do this because a targeted list sells for more and yields a better success rate than an unsorted file. These lists usually originate from old breaches, phishing campaigns, or malware-infected computers and are traded or given away on Telegram. Check If You Are Affected: If you have or had a po-box.mcgill.ca address, check it now with HEROIC's free breach scanner, which searches more than 400 billion breached records. If your address is listed, change that password right away, everywhere you've used it.