SOUTH AFRICA CORP-OTHERS-PRO MAILS TEST SAMPLE: 921 Corporate Logins Leaked

SOUTH AFRICA CORP-OTHERS-PRO MAILS TEST SAMPLE: What HEROIC Analysts Found

On 22-Feb-2026, HEROIC threat analysts identified a combolist file titled "SOUTH AFRICA CORP-OTHERS-PRO MAILS TEST SAMPLE" shared by a Telegram user. The file contained 921 records pairing email addresses with plaintext passwords and the URLs of the accounts they belong to. The name indicates the credentials were pulled from South African corporate email accounts and offered as a "test sample," a small preview batch sellers often release before distributing a larger file.

Why This Is Dangerous

Corporate email accounts often provide access to far more than a single inbox. They can be tied to internal systems, client communications, invoicing platforms, and other business tools, so a compromised corporate login can expose an entire organization, not just one employee. Because this file is a "test sample," it may also be a preview of a larger, more damaging dataset still circulating privately.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

When corporate credentials leak, the risk extends beyond the 921 individuals in this file to their employers and any clients or partners connected through those accounts. These plaintext passwords can be tested immediately in credential stuffing attacks against business platforms, and any reused password puts personal accounts at risk too, opening the door to account takeover, identity theft, and financial fraud.

How Combolists Work

A combolist pairs stolen login identifiers, in this case corporate email addresses, with their passwords, and is often organized by company, region, or account type to make the data more useful to buyers. Sellers frequently release a small "test sample" like this one to prove the data is real and current before offering a full, paid version of the file to interested buyers on forums and platforms like Telegram.

Check If You Are Affected

If you use a corporate email account, especially one tied to a South African business, it is worth checking whether your credentials appear in this or a related leak. HEROIC's free breach scanner searches more than 400 billion leaked records, so you can check your email in seconds and alert your organization if you find a match.