Researchers Link 2.5kk SUHQ Base to 2.4M Credentials on Telegram

HEROIC analysts identified this stealer log on 02-Apr-2023. The breach exposed 2,423,492 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as 2.5kk mix suhq base uploaded by a Telegram User.

Why This Is Dangerous

At 2.4 million records, the 2.5kk Mix SUHQ Base is one of the larger credential collections to surface on Telegram. The SUHQ (Semi-Ultra High Quality) designation means the credentials have undergone at least partial verification, making them immediately usable for account takeover attacks. The mix format indicates data was aggregated from multiple stealer sources and combined into a single high-value package for criminal buyers.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

A 2.4-million-record credential collection gives criminals enormous reach for automated credential stuffing campaigns. Even a 1% success rate against commonly used services translates to over 24,000 compromised accounts. Combined with the SUHQ quality label—indicating partial verification—these credentials are immediately weaponized for financial fraud, account resale, and identity theft against victims worldwide.

How Stealer Logs Work

Stealer logs are assembled from infostealer malware infections across multiple devices and regions. Criminals deploy infostealers through phishing emails, pirated software, and malicious browser extensions. Once installed, the malware extracts saved passwords, session cookies, and autofill data. Large mix collections like this one aggregate records from several separate infections or prior leaks, then sort and verify them before selling the package on dark web markets and Telegram channels.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to find out if your credentials appear in this breach or others. Free, takes seconds.