The Opencart_WRTCloud Leak Put 2,862 Logins on the Dark Web

In February 2026, HEROIC analysts identified a combolist named "opencart_wrtcloud" uploaded to Telegram. The file contains 2,862 records pairing email addresses with plaintext passwords and the URLs where each login was used, with a name suggesting the credentials are tied to OpenCart-based online stores or a related cloud service.

Why This Is Dangerous

Because the passwords in this dump are plaintext, an attacker does not need to crack or decrypt anything before testing them. If the credentials belong to store administrator or customer accounts, a working login could expose order histories, saved payment details, or give an attacker control over a storefront.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to each account

Why This Matters

Anyone whose login appears in this file is at risk of account takeover, and if the password was reused on other sites, attackers can attempt the same credentials elsewhere through credential stuffing. For an online store, a compromised account can also open the door to fraud against customers who trusted that storefront.

How This Combolist Was Put Together

Combolists like "opencart_wrtcloud" are typically built by pulling login pairs from malware infections, phishing pages, or older breaches, then grouping them by platform or theme before posting the finished file to Telegram channels where other criminals trade and resell stolen credentials.

Check If You Are Affected

Run a free scan with HEROIC's breach checker, which searches your email against more than 400 billion leaked records, and change any password you have reused across multiple accounts.