The 102k UHQ Leak Has More Logins Than a Sold-Out Stadium

In December 2022, a combolist file labeled "102k UHQ Combo Target Shopping sites" was uploaded to Telegram, and HEROIC analysts have since tracked its continued circulation. The file contains 99,170 records pairing email addresses with plaintext passwords and associated URLs, all targeting accounts used on online shopping sites.

Why the 102k UHQ Shopping Combolist Is Dangerous

With nearly 100,000 plaintext credentials in one file, this is a large enough dataset to fill a sold-out stadium with affected accounts. Every password can be read instantly with no cracking needed, and because the file is built specifically around shopping site logins, an attacker can move straight to placing fraudulent orders or draining stored payment methods.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

Shopping accounts often have saved payment cards, shipping addresses, and order histories attached, which makes them valuable targets on their own and useful stepping stones to other accounts if the password was reused. If your credentials are among the 99,170 exposed records, an attacker could attempt fraudulent purchases, credential stuffing on other sites, or use your personal details for identity theft.

How Combolists Targeting Shopping Sites Get Built

A combolist is a compiled file of email or username and password pairs, usually gathered from earlier breaches, phishing pages, or malware infections rather than a single fresh hack. Sellers label files as "UHQ," meaning ultra high quality, to signal the credentials have been verified as still working, and organizing them around shopping sites lets buyers target accounts likely to hold payment information.

Check If Your Shopping Account Was Exposed

If you want to know whether your email address appears in this combolist or any other leaked dataset, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. It takes seconds to check, and if you find a match, changing that password everywhere you have reused it is the fastest way to shut the door on attackers.