The clds.net Leak Gave Attackers 22,236 Ready-to-Use Login Credentials

HEROIC analysts identified a combolist tied to the domain clds.net, uploaded to a Telegram channel on June 10, 2026. The file contains 22,236 records pairing email addresses with plaintext passwords, along with URLs pointing to the clds.net login page associated with each account.

What Attackers Can Do With the clds.net Leak

With more than 22,000 working email and password pairs in plaintext, an attacker has everything needed to run large-scale login attempts against clds.net accounts immediately. They can also feed these same credentials into automated tools that try the same email and password combination across many other websites at once.

What Was Exposed in This Combolist

• Email addresses
• Plaintext passwords
• URLs linked to the clds.net login page

Why This Matters for These 22,236 Accounts

A leak of this size gives attackers a large enough sample to make credential stuffing worthwhile, testing each pair against banking, email, and shopping sites in bulk. If any of these 22,236 people reused their clds.net password elsewhere, their other accounts are exposed to takeover, financial fraud, or identity theft.

How Combolist Leaks Like This One Work

A combolist compiles working email or username and password pairs, often gathered from phishing pages, malware infections, or previously breached data, and organizes them around the specific site they apply to. A file this size, built entirely around clds.net, gives buyers a ready-made target list rather than a scattered mix of unrelated credentials.

Check If You Are Affected by the clds.net Leak

HEROIC maintains a database of more than 400 billion breached and leaked records, including combolists like this one. Use HEROIC's free breach scanner to check whether your email address appears in this 22,236-record leak or any other exposure, and find out which passwords you should change first.