2.5KK UHQ VPN Base Leaks 2.07 Million Plaintext Passwords

In January 2023, a stealer log named "2.5KK UHQ VPN Target Base" was uploaded to Telegram by an anonymous user. The file contains 2,071,045 records of email addresses, plaintext passwords, and associated URLs, all harvested from devices infected with information-stealing malware and specifically curated around VPN service logins. The name itself is underground shorthand: "2.5KK" signals roughly 2.5 million records, "UHQ" means "ultra high quality," a label sellers use to advertise that the logins are fresh and likely still active, and "VPN target Base" tells buyers the collection is built around VPN account credentials.

Why a "UHQ" VPN Credential Base Is Especially Risky

Sellers label a leak "UHQ" specifically because the credentials inside are verified as live and recently used, not old, expired data scraped from an ancient breach. Combined with a VPN focus, this dump is attractive to attackers because VPN accounts often act as a gateway into corporate networks, remote work systems, and other services a victim connects to while using that VPN.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each password to the VPN or related service it unlocks

Why This Matters

Plaintext, verified, VPN-targeted credentials are close to a best-case scenario for an attacker. This combination is built for credential stuffing at scale, and a successful login can lead directly to account takeover, unauthorized network access, identity theft, and financial fraud, particularly for anyone who reuses their VPN password across other accounts.

How a VPN-Targeted Stealer Base Gets Built

Information-stealing malware infects a device, often through a cracked application or malicious download, then copies every password saved in the browser or VPN client along with the web address or service it connects to. Criminals then sort and filter millions of these stolen entries into themed collections, like this VPN-focused base, before advertising them as "UHQ" on Telegram and dark web marketplaces to buyers looking for high-value, working logins.

Check If You Are Affected

If you use a VPN service and haven't changed your password recently, it's worth checking now. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including stealer logs like this one, to show you whether your email or password has been exposed.