Privacy-Focused Protonmail Users: 941 Accounts Just Leaked

On 10 June 2026, a combolist titled "protonmail.ch - 941 emails" appeared on Telegram. HEROIC verified the file contains 941 records of email addresses, plaintext passwords, and associated URLs, all connected to Proton Mail, a service best known for its privacy-focused, encrypted email accounts.

Why This Is Dangerous

People who choose Proton Mail often do so specifically because they value privacy and security, which makes them a notable target: their accounts may guard more sensitive communications than the average inbox. Because the passwords in this file are plaintext, any of these 941 accounts can be accessed immediately by whoever holds the file.

What Was Exposed

The "protonmail.ch - 941 emails" combolist contains:

• Email addresses (protonmail.ch-associated)
• Plaintext passwords
• Associated URLs

Why This Matters

For users who chose Proton Mail for privacy, an account takeover isn't just inconvenient, it can expose the very communications they were trying to protect. Beyond direct inbox access, reused passwords from this list could open the door to account takeover on other services, financial fraud, or identity theft.

How This Combolist Was Built

Combolists targeting a specific email provider like protonmail.ch are typically built by filtering a broader collection of stolen credentials down to just the accounts tied to that domain, making the file more useful to buyers interested in that particular user base. The credentials themselves usually originate from phishing pages, stealer malware, or older breaches rather than a direct compromise of Proton Mail's own systems.

Check If You Are Affected

If you use Proton Mail or any other email service, it's worth checking your exposure. HEROIC's free breach scanner searches more than 400 billion leaked records, including this combolist, to tell you if your account is one of the 941 affected.