The 231092 UHQ Mix Corp Leak: 131,947 Records Still Circulating

HEROIC analysts identified a combolist called 231092 UHQ Mix Corp that was originally leaked on February 11, 2025 and later flagged circulating on a Telegram channel. The file contains 131,947 records pairing email addresses or usernames with plaintext passwords, along with URLs identifying the accounts involved. Why This Is Dangerous This leak has been circulating for well over a year before HEROIC analysts flagged it, giving attackers plenty of time to test and reuse the credentials inside. Because the passwords are stored in plaintext, anyone with the file can attempt to log in immediately, and the included URLs show exactly which sites each set of credentials was originally used on. What Was Exposed Email addresses Plaintext passwords URLs tied to each account Why This Matters With 131,947 records in circulation, this combolist is large enough to be valuable to automated credential stuffing operations that test stolen logins across banking, email, and shopping sites at scale. The longer a leak like this stays in circulation, the more times it gets copied, resold, and reused, increasing the odds that any given password has already been tried somewhere else. How Combolist Attacks Work A combolist bundles usernames or emails with matching passwords, typically gathered from previous breaches, phishing campaigns, or malware infections, then compiled into a single file for resale or free distribution. Because the data requires no decryption, files like 231092 UHQ Mix Corp can keep resurfacing on different Telegram channels and dark web forums long after they first appear. Check If You Are Affected Given how long this data has likely been circulating, it is worth checking whether your information is part of it. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, so you can quickly find out if you were exposed and update any passwords you may have reused.