t-online.de Email Provider Leak: 9,559 Login Credentials Exposed

What HEROIC Analysts Found in the t-online.de Leak

HEROIC's dark web monitoring team identified a combolist named "t-online.de" uploaded to Telegram and dated February 20, 2025. The file contains 9,559 records pairing email addresses with plaintext passwords and the URLs of the accounts they belong to, with the name pointing to accounts tied to the t-online.de email service.

Why This Leak Is Dangerous

Email accounts are often the master key to a person's other logins, since most password reset links get sent there. Because this file stores plaintext passwords alongside the account URLs, an attacker can log into an exposed email inbox directly and then use it to reset passwords on other services tied to that address.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to each account

Why an Email Provider Leak Like This Matters

When the exposed accounts belong to an email provider, the risk goes beyond that one inbox. An attacker who takes over an email account can intercept password reset emails for banking, shopping, and social media accounts, turning a single leaked login into a chain of account takeovers, identity theft, and financial fraud.

How Combolists Like This One Work

A combolist compiles previously stolen or leaked email and password pairs into one file, often organized around a particular service, as this one appears to be organized around t-online.de accounts. These files circulate on Telegram and dark web forums, where buyers test the credentials directly against the named service.

Check If You Are Affected

If you have or have had a t-online.de account, or if you reuse passwords across your email and other accounts, check your exposure now. HEROIC's free breach scanner searches more than 400 billion leaked records to tell you whether your email appears in this leak. Run a free scan and change any matching passwords right away.