The rz.uni-potsdam.de Leak: 639 Stolen Login Credentials Surface

HEROIC's threat intelligence analysts identified a combolist file titled "rz.uni-potsdam.de" circulating on Telegram in June 2026. The file contained 639 records, including email addresses and plaintext passwords, tied to a German university email domain. HEROIC added it to its breach database so affected users can check their exposure.

Why the rz.uni-potsdam.de Leak Is Dangerous

The data in this file is not encrypted or hashed. It is stored as plain, readable text, which means anyone who downloads the rz.uni-potsdam.de file can immediately see a real email address next to its matching password, with no cracking or decryption required. That makes it usable the moment it is downloaded.

Because the passwords are plaintext, an attacker does not need any special skill to abuse them. They can simply load the 639 email and password pairs into automated software and start testing them against email providers, banking sites, and social media platforms within minutes.

What Was Exposed in the rz.uni-potsdam.de Leak

• Email addresses
• Plaintext passwords
• Associated login URLs

Together, these three pieces of data give an attacker everything needed to attempt a direct login: who the account belongs to, what the password is, and where to use it.

Why the rz.uni-potsdam.de Leak Matters for Your Accounts

Most people reuse the same password, or a close variation of it, across multiple accounts. If your email and password appear in the rz.uni-potsdam.de file, criminals can attempt to log into your email, banking, or shopping accounts using that exact combination, a tactic called credential stuffing.

A successful login can lead to account takeover, where an attacker locks you out and uses the account for fraud, spam, or further scams against your contacts. Stolen email access in particular is dangerous because email is often used to reset passwords on every other account you own, turning one leaked password into a much larger identity theft problem.

How the rz.uni-potsdam.de Combolist Was Likely Built

A combolist is not usually the product of a single hack. Instead, criminals pull email and password pairs from older breaches, stealer logs, and phishing pages, then merge them into one plain text file formatted as "email:password" or "username:password:URL." The rz.uni-potsdam.de file follows that same pattern.

Once compiled, combolists are traded or given away on Telegram channels and dark web forums, where other criminals load them into automated tools. Those tools test each pair against hundreds of popular websites in minutes, a technique known as credential stuffing. The people behind the rz.uni-potsdam.de file may never have breached anything directly. They simply repackaged stolen data and put it back into circulation.

Check If You Are Affected by the rz.uni-potsdam.de Leak

If you think your email address could be part of the rz.uni-potsdam.de file, or any of the 639 records in this leak, you can find out for free. HEROIC's breach scanner checks your email against a database of more than 400 billion leaked records, including this file, so you can see exactly what has been exposed.

If you are affected, change the password on any account tied to that email right away, and avoid reusing it anywhere else. Running a free scan takes less than a minute and can tell you whether this leak, or any other, already put your accounts at risk.