21k UHQ Pvt Part 1: 21,062 Email and Password Pairs Leaked

In January 2023, HEROIC analysts uncovered a stealer log titled "21k UHQ pvt part 1," uploaded to Telegram by an unidentified user. The file contained 21,062 records of email addresses, plaintext passwords, and the URLs tied to each set of credentials.

Why the 21k UHQ Pvt Log Is Dangerous

Files labeled "UHQ," short for ultra high quality, and "private" are marketed among criminals as containing fresh, working credentials rather than old or recycled data. Combined with the fact that the passwords here are stored in plaintext, this makes the file immediately usable, an attacker does not need any special tools to start testing the logins.

What Was Exposed in the 21k UHQ Pvt Part 1 Log

• Email addresses
• Plaintext passwords for each account
• URLs showing the login pages the credentials were used on

Why This Matters

Fresh, working credential pairs like these are ideal for credential stuffing, where automated tools try each email and password combination across many popular websites. If a password from this file was reused on another account, that account becomes vulnerable to takeover, which can escalate into fraud, spam, or identity theft depending on what the account controls.

How Stealer Logs Work

Rather than hacking a company directly, criminals behind stealer logs infect individual computers with malware, often through cracked software or malicious downloads, that quietly extracts saved passwords and autofill data from the browser. The results are compiled into files like this one, sometimes split into numbered parts as sellers process large batches, and then distributed through Telegram channels and underground marketplaces.

Check If You Are Affected

If you want to know whether your credentials appear in a leak like this, HEROIC's free breach scanner searches a database of more than 400 billion leaked records to give you a fast, clear answer on your exposure.