If You Use DirectAdmin, the Vuln_DirectAdmin Leak Should Concern You

HEROIC analysts found a combolist labeled "Vuln_DirectAdmin" uploaded to a Telegram channel on June 27, 2026. The file holds 131 records pairing email addresses, plaintext passwords, and login URLs. The name suggests a connection to DirectAdmin server control panels, though HEROIC found no confirmation this came from an actual DirectAdmin systems breach rather than a targeted collection of DirectAdmin-related logins. Why This Is Dangerous: Server control panel logins are especially sensitive because they can grant access to entire websites and the data behind them. If these are genuine, working DirectAdmin credentials, an attacker could use them to take over hosting accounts, not just individual user accounts. What Was Exposed: - Email addresses tied to DirectAdmin-related logins - Plaintext passwords - URLs pointing to the login pages involved Why This Matters: Even at 131 records, a leak like this is dangerous if you administer a website or server, because a single compromised control panel login can expose everything hosted on it. And if you reused that password on personal accounts, the same credential stuffing risk applies there too. How a Combolist Like This Works: Combolists targeting specific software, like DirectAdmin, are often built by scanning the internet for exposed login pages, then testing common or previously leaked passwords against them. The successes get compiled into a file like this one and circulated as a ready-made target list. Check If You Are Affected: If you manage a server or website through DirectAdmin, check your email against this leak and HEROIC's full database of more than 400 billion exposed records using HEROIC's free scanner, then rotate your password if you find a match.