The Belarus Corp Mail Sample Leak Lets Attackers Test 1,048 Logins

In February 2026, HEROIC analysts identified a combolist labeled "BELARUS CORP-OTHERS-PRO MAILS TEST SAMPLE" uploaded to a Telegram channel. The "test sample" language is a common tactic among sellers, offering a small preview of stolen data to prove it's genuine before selling a larger set. This sample alone, dated February 22, 2026, contains 1,048 records made up of email addresses, plaintext passwords, and associated URLs tied to corporate mail accounts. What Attackers Can Do With 1,048 Corporate Mailboxes With a working email and plaintext password in hand, an attacker can log straight into a corporate mailbox, read internal communications, and impersonate the account owner. That access is often used to send convincing fraudulent invoices or wire transfer requests to business partners, a scam known as business email compromise, and to pivot toward other internal systems if the same password was reused anywhere else in the organization. What Was Exposed in the BELARUS CORP-OTHERS-PRO Sample Corporate email addresses Plaintext passwords Associated URLs Why This Matters Because this file is labeled a sample, the full dataset behind it may be significantly larger, and whoever is selling it is using these 1,048 records to prove the data works before a bigger transaction. For the businesses and individuals behind these accounts, that means credential stuffing, account takeover, and financial fraud are all realistic outcomes if the passwords aren't changed quickly. Check If You Are Affected If your organization uses corporate email accounts tied to Belarus, or you've reused a work password elsewhere, it's worth checking now rather than waiting for the full dataset to surface. HEROIC's free breach scanner searches more than 400 billion exposed records, so you can find out quickly and update any compromised passwords before attackers do.