The T-online.de Combolist Contains Exactly 29 Email and Password Pairs

HEROIC analysts found a combolist tied to T-online.de, the German email and internet service, uploaded to a Telegram channel on June 14, 2026. The file contains exactly 29 records, each pairing an email address with a plaintext password and a URL pointing to the T-online.de login page.

Why the T-online.de Leak Is Dangerous

With only 29 records, this file is small, but every credential in it is stored in plaintext and paired with the exact login page it works on. That combination means an attacker does not need to guess or crack anything before attempting to access these T-online.de email accounts.

What Was Exposed in This Combolist

• Email addresses
• Plaintext passwords
• URLs linked to the T-online.de login page

Why This Matters for These 29 Accounts

Email accounts are often the key to resetting passwords on banking, shopping, and social media accounts, so a compromised T-online.de inbox can quickly become a gateway to other accounts. If any of these 29 people reused their T-online.de password elsewhere, attackers can use credential stuffing to break into those accounts too, opening the door to financial fraud or identity theft.

How Combolist Leaks Like This One Work

A combolist compiles working username or email and password pairs, often collected from phishing pages, malware infections, or older breaches, and groups them by the site they apply to. Combolists organized around a single provider, like this T-online.de file, let an attacker focus their efforts on one platform instead of sorting through an unrelated mix of credentials.

Check If You Are Affected by the T-online.de Leak

HEROIC maintains a database of more than 400 billion breached and leaked records, including combolists like this one. Use HEROIC's free breach scanner to check whether your email address appears in this leak or any other exposure, and find out which passwords you should change first.