Dark Web Intel: 546 Portal.att.net Credentials Just Leaked

In June 2026, HEROIC analysts identified a combolist titled "portal.att.net - 546 emails" uploaded to Telegram. The file contained 546 records pairing email addresses with plaintext passwords tied to AT&T's portal.att.net login page.

Why This Is Dangerous

This file was built specifically around one login portal, which means every credential in it comes with a clear target already attached. Because the passwords are plaintext, an attacker can immediately try each email and password against portal.att.net without any extra work.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs

Why This Matters

A small, targeted list like this can still cause serious harm. If your credentials are among the 546 in this file, an attacker already knows the exact site to try them on. If you reuse that password anywhere else, including email or banking, a single successful login could open the door to account takeover, financial fraud, or identity theft.

How This Combolist Was Built

A targeted combolist like this one is created by filtering a larger batch of stolen or phished credentials down to accounts tied to one specific service, in this case AT&T's customer portal. Attackers do this because a focused list is easier to test quickly and often sells for more than a mixed, unsorted file. Telegram is a common channel for distributing these targeted lists once they are compiled.

Check If You Are Affected

With 546 records tied to one specific login page, it only takes a moment to check whether you were included. HEROIC's free breach scanner searches your email against a database of more than 400 billion leaked records, including this one, and tells you in seconds if you were affected. If you find a match, change that password right away and anywhere else you have reused it.