Your Data May Be Exposed. The 11k HQ Combolist Leaked 11,349 Logins.

In January 2023, HEROIC analysts identified a combolist named "11k HQ Mixed Combolist," uploaded by a Telegram user, exposing 11,349 records made up of email addresses, plaintext passwords, and the URLs each login was used on.

Your Login Could Already Be in This File

This is not a single-source leak tied to one website or email provider, the "mixed" label means it pulls accounts from many different services into one combined list. Labeled "HQ," or high quality, it also means the entries have been checked and are considered likely to still work, which means your account could be sitting in this file right now with no obvious warning sign that anything is wrong.

What Was Exposed

• Email addresses from a mix of different online services
• Plaintext passwords, stored with no encryption
• URLs identifying the exact site each credential belongs to

Why This Matters

Because the accounts in this list are mixed across many services and marked as high quality, attackers can use it to attempt logins across a wide range of targets, from email and social media to banking and shopping sites. For the 11,349 people in this file, that means real exposure to account takeover, credential stuffing, and financial fraud.

How a Mixed HQ Combolist Gets Assembled

The process starts with individual stealer logs, malware-collected credentials from many different infected devices and services. Someone combines these logs together, verifies which logins still work, and packages the confirmed entries into a single mixed list labeled "HQ" to signal its quality to buyers before uploading it to Telegram for sale or trade.

Check If You Are Affected

With accounts pulled from many services mixed into one file, checking your exposure matters no matter which sites you use. HEROIC's free breach scanner checks your email address against a database of more than 400 billion breached and leaked records, so you can find out in seconds and secure any exposed account.