SFR.fr Combolist Leak: What Attackers Do With 586 Logins

SFR.fr Combolist: 586 Credentials Leaked

In May 2026, HEROIC analysts tracked a combolist uploaded to a Telegram channel referencing sfr.fr accounts. The file contained 586 records pairing email addresses with plaintext passwords, along with the URLs the credentials were tied to. While small compared to major breaches, every one of these 586 accounts is now sitting in a file that any attacker on that Telegram channel can download and use immediately.

What Attackers Can Do With This Data

Because the passwords in this file are stored in plaintext, an attacker does not need to crack or decrypt anything. They can simply copy the email and password pair and try logging in right away. If the URL field points to sfr.fr or a related service, attackers already know exactly where to aim, cutting out the guesswork that normally slows down an attack.

The bigger risk is password reuse. If any of these 586 people used the same password on their email, banking, or shopping accounts, an attacker can try that same combination there too, often within minutes of the file being shared.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated accounts

Why This Matters

Even a small combolist like this one feeds directly into credential stuffing campaigns, where automated tools test each email and password pair against many popular sites at once. A single reused password can lead to account takeover, unauthorized charges, or identity theft. Because the data was posted openly on Telegram, it can also be copied and redistributed indefinitely, meaning exposure does not go away on its own.

How a Combolist Attack Works

A combolist is a compiled list of username or email and password pairs, usually pulled together from older leaks, malware infections, or previous breaches and repackaged into a single file. Criminals distribute these lists on channels like Telegram, where other attackers download them and run them through automated login tools. Because the sfr.fr list stores passwords in plaintext, there is no encryption standing between the data and misuse, which makes even a small file like this one immediately dangerous to the people in it.

Check If You Are Affected

If you have ever had an account tied to sfr.fr, it is worth checking whether your details appear in this leak. HEROIC's free breach scanner searches a database of more than 400 billion leaked records and will tell you instantly if your email shows up. If it does, change that password immediately and make sure you are not using it anywhere else.