The WRTCloud Combolist Leak Exposed 106,725 US Accounts and Passwords

HEROIC analysts discovered a new combolist circulating on Telegram in March 2026, uploaded directly by a user under the label "wrtcloud private." The file contains 106,725 records pairing email addresses with plaintext passwords, along with the URLs of the accounts they unlock. Because the passwords sit in plaintext, anyone who downloads the file can use the credentials immediately without needing to crack or decode anything. Why this is dangerous: A plaintext combolist is one of the most immediately usable breach formats an attacker can find. There is no encryption to break and no hash to crack, the username, password, and destination URL are handed over in a ready-to-use format. Anyone with access to this file can attempt to log into the associated accounts within minutes, and automated tools make it possible to test all 106,725 entries against dozens of popular websites and services in a single pass. What was exposed: the dataset includes email addresses used as account logins, plaintext passwords with no encryption protecting them, and the specific URLs tied to each set of credentials, effectively a roadmap showing attackers exactly which site each password combination unlocks. Why this matters: Most people reuse the same password across multiple accounts, so a single exposed combination can unlock far more than the original account. Attackers use lists like this one to run credential stuffing attacks, automatically testing stolen logins against email providers, banking portals, and social media platforms. When a match is found, the result is account takeover, and from there, identity theft and financial fraud become the next steps. How this combolist was built: A combolist is simply a compiled list of username and password pairs, often pulled together from multiple smaller breaches, stealer logs, or phishing campaigns and merged into one file. These files are frequently shared for free or sold cheaply in Telegram channels and dark web forums, which lowers the barrier for even low-skill attackers to get their hands on working credentials. The inclusion of URLs in this particular file makes it especially convenient for criminals, since it removes the guesswork of figuring out where each login actually works. Check if you are affected: if you have ever used an email address in the United States for an online account, it is worth checking whether your information appears in this or any other breach. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to tell you instantly if your email or password has been exposed, so you can change compromised credentials before someone else uses them first.