Labeled 40K, the SFR.fr Combolist Contains Exactly 38,535 Logins

HEROIC analysts identified a dataset, tracked as COMBOLIST 40K SFR.FR FRESH 100, that a Telegram user uploaded on 28-Oct-2025. Despite the "40K" in the name, HEROIC's own count of the file shows 38,535 records, including email addresses, plaintext passwords, and the login page URLs tied to those accounts, targeting SFR.fr webmail users.

Why This Is Dangerous

Sellers often round up or exaggerate combolist sizes to make a listing look more attractive, but the real number here, 38,535 confirmed records, is still large enough to run through automated tools that test every pair against multiple websites at once. Each record hands over a working email address, a plaintext password, and the exact site it opens.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

With 38,535 records in this combolist, attackers have a solid list to run credential stuffing campaigns against SFR.fr and other services. If a password from this file is reused elsewhere, it can lead to account takeover, and in more serious cases identity theft or financial fraud.

How Combolists Work

A combolist is built by combining email and password pairs from multiple sources, often older breaches, stealer log malware, and previously leaked databases, then merging and cleaning them into one file. Sellers label combolists by provider, size, and freshness to attract buyers, as seen here with a batch targeting SFR.fr users and marked "fresh," before sharing them through channels like Telegram.

Check If You Are Affected

If you want to know whether your information appears in this COMBOLIST 40K SFR.FR FRESH 100 file or any other breach, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. Run a scan now and change any password that may have been exposed.