The valid_ftps Leak Surfaced Days Ago. FTP Credentials Now Exposed

On August 2, 2026, just days before this report, HEROIC analysts found a combolist named valid_ftps uploaded to a Telegram channel by an anonymous user. The file contains 261 records pairing email addresses with plaintext passwords and the URLs of the FTP accounts they unlock.

Why the valid_ftps Leak Is Dangerous

FTP credentials are used to access the file storage systems behind websites, not just personal accounts. A working login from this list could let an attacker upload malicious files, download sensitive data, or deface a website entirely, all without needing to guess a password since the file is labeled "valid" and stores everything in plaintext.

What Was Exposed in the valid_ftps Leak

• Email addresses
• Plaintext passwords
• URLs linking each login to its FTP server

Why This Matters

Even a small leak like this one carries outsized risk because of what FTP access controls. If any of these 261 credentials are reused elsewhere, or if they belong to a business's web server, the consequences can range from a compromised personal email account to a full website takeover, with follow-on risks of financial fraud or identity theft for anyone whose data passes through that server.

How Combolists Work

A combolist pairs usernames or email addresses with passwords, usually collected from older breaches, malware logs, and prior leaks. Criminals test these credentials against many different login systems using automated tools, and a list labeled "valid" like this one means those tests have already been run, so every entry is confirmed to work.

Check If You Are Affected

Since this leak surfaced just days ago, it's worth checking now whether your email or passwords are part of the valid_ftps combolist or any other breach. HEROIC's free breach scanner searches a database of more than 400 billion leaked records in seconds.