Search Your Email: The Vuln_FTP Leak Exposed 10,058 Server Logins

HEROIC analysts identified a file named Vuln_FTP uploaded to a Telegram channel in July 2026. FTP, or File Transfer Protocol, is used to upload and manage files directly on a server, often the same server hosting a website or business application. The file contains 10,058 records pairing email addresses with plaintext passwords and the URLs those FTP accounts connect to. Why This Is Dangerous: FTP access gives an attacker direct control over the files stored on a server. That can mean uploading malware, replacing website files with malicious versions, or downloading sensitive documents and databases stored there. Because the passwords in this file are plaintext, anyone who downloads it can start testing logins immediately. What Was Exposed: - Email addresses - Plaintext passwords - URLs tied to the FTP accounts Why This Matters: A list of over 10,000 working FTP credentials is a significant find for attackers running website compromise campaigns. Working FTP access lets them plant malicious code that infects site visitors, exfiltrate business files, or use the compromised server to launch further attacks. If your hosting account uses one of the passwords in this file anywhere else, the risk extends well beyond your website to any other account sharing that password. How a Combolist Like This Works: This type of list is built by scanning the internet for exposed FTP login panels and testing known or leaked password combinations against them, keeping only the ones confirmed to work, which is what the vuln label signals. Attackers trade or sell these verified lists on Telegram because a working FTP login is immediately useful, unlike an unverified guess. Check If You Are Affected: Run a free scan against HEROIC's database of more than 400 billion breached records to see if your email address appears in this leak or any other. If you manage an FTP server, change the password immediately, switch to SFTP or another encrypted transfer method if possible, and review your server's file changes for anything unauthorized.