The sapo.mz Leak Exposed 964 US Email and Password Records

HEROIC analysts identified a combolist labeled "sapo.mz - 964 emails" that was uploaded to Telegram, tied to a leak dated June 10, 2026. The file contains 964 records pairing email addresses with plaintext passwords, along with the login URLs those credentials are associated with.

Why This Is Dangerous

These 964 passwords are stored in plaintext, so anyone who obtains the file can read each password exactly as the account holder typed it, with no need to crack or decrypt anything. Paired with the matching login URL, an attacker can go straight to the sign in page and attempt access immediately.

What Was Exposed

• Email Addresses
• Plaintext Password
• URLs

Why This Matters

A file this size may look small compared to headline breaches, but every one of the 964 people affected faces the same real risk. If any of them reused their email and password on another site, whether a bank, another email account, or a social platform, an attacker can use this leak to attempt to log in there too, a tactic known as credential stuffing.

How Combolists Work

A combolist pairs email or username with a password, usually one pair per line, and is typically compiled from older breaches, phishing pages, or malware infections before being repackaged and shared on Telegram. Once a file like this one circulates, anyone can download it and run the credentials through automated tools that test the same login across many other websites at once.

Check If You Are Affected

Rather than wondering whether your email is one of the 964 exposed in this leak, use HEROIC's free breach scanner to check right now. HEROIC checks your email against a database of more than 400 billion leaked records, including this one, so you can find out immediately and change any reused passwords before someone else does.