The SFR.fr Combolist Was Made in 2023. It’s Still Circulating Today.

In March 2023, HEROIC analysts identified a small combolist titled 135 SFR.FR Hits by x_NIKE2_x shared on Telegram. The file contained 104 records, each combining an email address, a plaintext password, and the URL the credentials are tied to, all associated with SFR.fr accounts. Why the SFR.fr combolist still matters years later: this credential set was compiled back in March 2023, but files like this rarely disappear once they're created. They get reshared, resold, and recirculated on Telegram for years, meaning the 104 people in this leak may only now be seeing the consequences of a password that was stolen a long time ago. What was exposed in the SFR.fr hits leak: email addresses, plaintext passwords, and URLs tied to each SFR.fr login. Why an old, small leak is still a real risk: a leak of 104 records might look tiny, but every one of those records ties a real email to a real password. If those passwords were never changed, they still work today, and attackers use exactly this kind of aging, recirculated data for credential stuffing, account takeover, and identity theft, betting that people forget about old leaks. How combolists like this get labeled and traded: attackers often label small combolists with the target service, SFR.fr in this case, and the handle of whoever hit or harvested the credentials, here x_NIKE2_x, as a kind of signature. These smaller, hand-labeled files often circulate quietly for years within Telegram groups, long after the original theft. Check if you are affected: even a small, older leak is worth checking. HEROIC's free breach scanner searches more than 400 billion leaked records, so you can see immediately whether your email and password have surfaced, no matter how long ago the breach happened.