22,472 Italian Accounts Exposed in the ’25K UHQ Italy Base’ Leak

HEROIC analysts identified a combolist labeled "25K UHQ Italy Base" uploaded to a Telegram channel on July 7, 2026. Despite the "25K" in its name, the verified file contains 22,472 records of email addresses paired with plaintext passwords and the URLs where those logins were used, marketed as a high quality batch of Italian accounts.

Why a "High Quality" Combolist Is More Dangerous

Sellers label files "UHQ," for ultra high quality, when the credentials inside have been checked and confirmed to actually work. That means the 22,472 email and plaintext password pairs in this file are not stale or expired guesses, they are live logins, ready for an attacker to use the moment they download the list.

What Was Exposed in the Italy Base Leak

• Email addresses
• Plaintext passwords
• URLs linked to the accounts

Why This Matters for These 22,472 Accounts

With working credentials confirmed in advance, attackers can move straight to credential stuffing, trying each email and password pair across banking, email, and shopping sites. Anyone whose details appear in this file faces a real risk of account takeover, identity theft, or financial fraud, especially if the same password is reused on other accounts.

How This Italy-Focused Combolist Was Built

A combolist like this one is a plain text file of email-and-password pairs, gathered from older breaches, phishing pages, or malware logs and filtered down to accounts from a specific country or region, in this case Italy. Sellers verify the logins still work before labeling the file "UHQ" and posting it to Telegram, where it can reach buyers quickly with little effort.

Check If You Are One of the 22,472 Exposed Accounts

Because these credentials were verified as working, checking your exposure now matters more than usual. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including combolists like this Italy base, so you can find out quickly and change any reused passwords before someone else uses them.