The ric.edu Leak: 897 Emails Sat Online for Weeks Before Discovery

What HEROIC Analysts Found in the ric.edu Combolist HEROIC analysts identified a combolist labeled "ric.edu - 897 emails" that had been uploaded to Telegram on June 10, 2026. By the time our team logged it, the file had been circulating for weeks. It contained 897 records pairing email addresses with plaintext passwords, along with URLs showing where each set of credentials was used, all tied to the ric.edu domain. Why the ric.edu Leak Is Dangerous The longer a file like this sits online before anyone notices it, the more chances attackers have had to download and use it. Because the passwords are stored in plaintext and paired with URLs, anyone who grabbed this file early could have already tested the credentials against the associated accounts, or against other sites where the same password might be reused. What Was Exposed in the ric.edu List Email addresses Plaintext passwords URLs identifying each account's login page Why This Matters for the 897 Accounts Involved A leak tied to a school or university domain like ric.edu often includes a mix of students, faculty, and staff email addresses. If anyone in this group reused their ric.edu password on a personal email, banking, or shopping account, that password is now available to anyone who found this combolist, opening the door to credential stuffing, account takeover, and potentially financial fraud or identity theft. How This Combolist Was Likely Built Combolists like this one are typically compiled by scraping email addresses tied to a specific domain and matching them with passwords pulled from older breaches, phishing pages, or malware-infected devices. Once assembled, the file is given a descriptive name, in this case referencing the ric.edu domain and the record count, and uploaded to Telegram, where it can sit and spread for weeks before it draws wider attention. Check If You Are Affected If you have a ric.edu email address or think your credentials may have been swept up in a leak like this one, it is worth checking now rather than waiting. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including combolists like this one, and tells you immediately if your information has been exposed. If it has, change that password right away and stop reusing it elsewhere.