The 1.5KK Mix UHQ Base Leak Gives Attackers 1.48 Million Logins

In April 2023, HEROIC analysts identified a large combolist called "1.5KK Mix UHQ Base" after a Telegram user uploaded it to a sharing channel. The file contains 1,488,255 records combining email addresses, plaintext passwords, and the login URLs tied to each credential. Why This Is Dangerous: "UHQ" stands for "ultra high quality" in combolist slang, meaning the credentials have been checked and are more likely to work. With nearly 1.5 million verified email and password pairs stored in plaintext, an attacker can run this file directly against major websites without wasting time on dead logins. What Was Exposed: Email addresses. Plaintext passwords. Associated login URLs. Why This Matters: Because the file is marketed as checked credentials, it is more dangerous than an unverified combolist of the same size. Attackers can skip straight to credential stuffing campaigns against banks, retailers, and email providers, knowing a higher percentage of the 1,488,255 logins will actually work. How This Combolist Was Likely Built: These lists are compiled by merging multiple older breaches and stealer logs, then running the combined data through checker tools that test each login against live websites and remove the pairs that no longer work. What remains is sold or shared as a high quality combolist, since every entry has already been confirmed active. Check If You Were Affected: With almost 1.5 million records in circulation, the odds of any one email being included are real. HEROIC's free breach scanner checks your address against more than 400 billion leaked records, including this file, so you know immediately whether you need to change a password.