The sandown.co.za Combolist Leak: 1,008 Passwords Exposed Online

What HEROIC Analysts Found

In June 2026, HEROIC's threat intelligence team identified a combolist tied to sandown.co.za after it was uploaded to Telegram by an individual user. The file contained 1,008 records pairing email addresses with plaintext passwords, along with associated URLs pointing to the accounts they unlock.

Why This Is Dangerous

The passwords in this leak were stored and shared in plaintext, meaning anyone who downloads the file can read your password exactly as you typed it. There is no cracking or guessing required. If that password is reused anywhere else, an attacker already has what they need to log in.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated account URLs

Why This Matters

A small combolist like this one is still dangerous because of how it gets used. Criminals feed lists like this into automated tools that test the same email and password combination across banking sites, email providers, and social media platforms, a technique known as credential stuffing. If even one of your accounts shares this password, that account can be taken over. From there, identity theft and financial fraud follow quickly.

How Combolists Work

A combolist is a text file that pairs usernames or email addresses with passwords, usually one pair per line. They are often assembled from smaller breaches, stealer logs, or scraped login pages, then repackaged and shared or sold in Telegram channels and on dark web forums. Because using one requires no technical skill, combolists are behind a large share of everyday account takeovers.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against a database of more than 400 billion breached records, including combolists like this one. If your information turns up, change that password right away and anywhere else you have used it.