Researchers Link the Chello.nl Dump to 18,676 Stolen Credentials

HEROIC analysts identified a combolist labeled "chello.nl - 18.676 emails," uploaded to Telegram in June 2026. The file contains 18,676 records, each pairing a chello.nl email address with a plaintext password and an associated URL.

Why the Chello.nl Leak Is Dangerous

Because every record in this list shares the same email domain, attackers can focus their efforts on one provider's users at once, increasing efficiency. An attacker armed with 18,676 working email and password pairs from a single domain can run a targeted credential stuffing campaign against that provider's login page and any service that accepts chello.nl addresses for sign-in.

What Was Exposed

• Email addresses (chello.nl domain)
• Plaintext passwords
• Associated URLs

Why This Matters

Domain-specific combolists like this one are frequently used to target a specific user base, whether for phishing, spam campaigns, or direct account takeover. If your chello.nl address and password appear here, an attacker already has a working login and could use it to access other accounts where the same password was reused.

How This Combolist Was Compiled

Combolists organized by email domain are usually built by filtering a larger breach or stealer log dataset down to records matching one provider, then packaging that subset for sale. This approach lets sellers market a smaller, more targeted file to buyers specifically interested in chello.nl account holders.

Check If You Are Affected

If you have ever used a chello.nl email address, checking your exposure only takes a moment. HEROIC's free breach scanner searches more than 400 billion leaked records, including this combolist, so you can confirm whether your credentials were part of this leak.