Researchers Link a Telegram Leak to 2,807 Exposed BYU.edu Accounts

Researchers Link a Telegram Combolist to 2,807 Exposed BYU.edu Accounts. On June 10, 2026, a Telegram user uploaded a combolist file targeting byu.edu email addresses. HEROIC's threat intelligence team identified and verified the listing on July 31, 2026, confirming it contains 2,807 records of email addresses, plaintext passwords, and associated URLs. Why This Is Dangerous. Because the list is focused on a single email domain, researchers can quickly tie the records back to a specific university community, making it easier for attackers to craft convincing phishing emails or target students and staff directly. The plaintext passwords mean any working credential can be used immediately, without cracking. What Was Exposed: Email addresses. Plaintext passwords. Associated login URLs. Why This Matters. University email accounts often connect to financial aid portals, health records, and campus payment systems, so a compromised byu.edu login can expose far more than just email. Students and staff who reused their university password elsewhere also face credential stuffing, account takeover, and identity theft risks. How Combolists Work. A combolist pairs stolen usernames or email addresses with passwords, typically pulled from older breaches, phishing campaigns, or malware infections and organized by domain to make them easier to target. Lists narrowed to a single school or organization, like this one, are especially useful to attackers running phishing campaigns against that specific community. Check If You Are Affected. HEROIC's free breach scanner checks your email address against more than 400 billion leaked records, including domain-specific combolists like this one. Run a free scan now to see if your byu.edu credentials were exposed.