If You Reuse Passwords, the sfr_fr Combolist Leak Should Worry You

On 26-Mar-2026, HEROIC analysts identified a combolist branded around the French telecom provider SFR (sfr.fr) after it was uploaded by a Telegram user. The file contained 17,429 records pairing email addresses with plaintext passwords and associated login URLs. Why This Is Dangerous Because the passwords in this file are stored in plaintext, no cracking is required. Anyone who downloads the file can immediately try each email and password pair against SFR's login page and other sites. If you reuse the same password across multiple accounts and your details are in this file, an attacker can walk straight into your accounts. What Was Exposed Email addresses Plaintext passwords Associated website URLs (the login pages tied to each credential) Why This Matters Combolists like this one are built for credential stuffing. Attackers load the email, password, and URL combinations into automated tools that test each login against telecom accounts, banking sites, and email providers. Because SFR accounts often connect to billing information and personal details, anyone in this file who reuses passwords faces a real risk of account takeover, identity theft, and financial fraud. How a Telegram Combolist Works A combolist is a plain text file of email and password pairs, typically gathered from older breaches, phishing pages, or malware-infected devices and then repackaged for resale or free distribution. Telegram channels have become a popular marketplace for these files because they are quick to set up, hard to trace, and reach thousands of buyers instantly. Combolists organized around a specific brand, like this sfr_fr file, are often curated that way to make the credentials look more targeted and valuable to buyers. Check If You Are Affected With 17,429 email and password pairs exposed in this leak, it is worth checking whether your information is included. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including combolists like this one, and tells you immediately if you have been exposed.