1.7KK UHQ MIX BASE Data Breach: 1,336,995 Passwords Leaked

HEROIC Analysts Identify the "1.7KK UHQ MIX BASE" Stealer Log

In April 2023, HEROIC's threat intelligence team identified a large stealer log circulating on Telegram under the name "1.7KK UHQ MIX BASE." The file contained exactly 1,336,995 records, each one pairing a victim's email address with a plaintext password and the URL of the login page that credential belonged to. It is now cataloged in HEROIC's breach intelligence database so anyone affected can check their exposure.

Why 1.3 Million Matched Email, Password, and URL Combinations Is a Serious Problem

Scale changes what's possible for an attacker. A list this size can be run through automated tools that test each email and password combination against its matching URL in seconds, checking millions of accounts with almost no manual effort. Because the passwords are stored in plain text and already linked to the correct login page, there's no cracking step involved. The bigger the file, the more efficient this kind of automated attack becomes.

What Was Exposed in the 1.7KK UHQ MIX BASE Log

• Email addresses for over 1.3 million individual victims
• Plaintext passwords, stored without encryption or hashing
• URLs identifying the exact login page each credential pair unlocks

Why This Matters at This Scale

With 1,336,995 records in a single file, the odds that your information could be among them are meaningfully higher than with a small, isolated leak. If your email and password combination appears here and you've reused that password on other sites, an attacker can attempt account takeover across email, banking, shopping, and social accounts simultaneously. At this volume, this kind of data is routinely used to fuel large-scale credential-stuffing campaigns and identity theft schemes.

How a "UHQ Mix" File of This Size Gets Assembled

"UHQ" is shorthand used in these communities for "ultra high quality" credential data, meaning it's been verified as recent and working rather than old or duplicated. Files like this are built by combining the output of information-stealing malware from thousands of infected devices, each one silently harvesting saved browser passwords and the URLs they belong to. The results are cleaned, deduplicated, and merged into a single "mix base" before being shared or sold, which is how a file can grow to over a million records.

Check If You're One of the 1,336,995 People in This Leak

Given the size of this file, checking your exposure directly is the only reliable option. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including large stealer logs like the 1.7KK UHQ MIX BASE, and tells you instantly if your email address is included. If you find a match, change that password immediately, stop reusing it elsewhere, and enable two-factor authentication on every account that offers it.