The sky.117.cx Data Leak: 716 Accounts Exposed Months Later

Inside the sky.117.cx Combolist: 716 Login Credentials Exposed

HEROIC analysts identified a combolist named sky.117.cx that was uploaded to a Telegram channel on May 25, 2026, containing 716 records of email addresses, plaintext passwords, and the website URLs those credentials belonged to. The file sat in circulation for months on Telegram before it was flagged and added to HEROIC's breach database on August 28, 2026, which means anyone who downloaded it early has had a long head start to test these logins elsewhere.

Why This Is Dangerous

Unlike breaches where passwords are hashed or encrypted, this combolist stores every password in plain, readable text. That removes the biggest obstacle an attacker normally faces. There is no cracking required, no guesswork involved. Anyone with the file can simply copy an email, password, and matching URL and attempt to log straight into the account it was paired with.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each credential pair to the site it was used on

Why This Matters

Because the passwords are already in plaintext and paired with working login URLs, this data is ready to use for credential stuffing the moment it changes hands. Attackers run these pairs against banking portals, email providers, and social media platforms in bulk, hoping victims reused the same password elsewhere. A single successful match can lead to full account takeover, followed by identity theft or financial fraud if the account is tied to a payment method or personal information.

How Combolists Work

A combolist is a simple text file that combines usernames or email addresses with passwords, usually gathered from older breaches, phishing pages, or malware infections and compiled into one list. Criminals trade and sell these files on Telegram and dark web forums because they require no technical skill to use. Automated tools can feed a combolist into hundreds of websites in minutes, quietly testing every pair until one works.

Check If You Are Affected

If you think an old or reused password might be sitting in a file like this one, it is worth finding out for certain rather than hoping it was not you. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including combolists like sky.117.cx, so you can see exactly what has been exposed and change any passwords that need it.