The ’29k HQ Mixed Combo’ File Contains Exactly 27,462 Records

Exactly 27,462 Records Inside the "29k HQ Mixed Combo"

HEROIC analysts examined a combolist, dated 08-Jan-2023, uploaded to a Telegram channel under the name "29k HQ mixed Combo." Rounded up in the name, the file actually contains exactly 27,462 records, each pairing an email address with a plaintext password and an associated login URL, described by the uploader as high-quality and pulled from a mix of sources.

Why an "HQ" Label Raises the Stakes

When an uploader marks a combolist "HQ," or high quality, it usually means the credentials have been checked and confirmed to work, unlike raw, unverified dumps that may contain outdated or incorrect logins. Because the passwords here are stored in plaintext, anyone who gets a copy can read every credential immediately and log in directly using the exact URL listed with it, with a higher chance of success than with an unverified list.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

A verified, mixed combolist like this one is attractive to attackers precisely because the credentials are more likely to still work, across a range of different sites rather than just one. Anyone among these 27,462 people who has reused a password faces a real risk of credential stuffing, account takeover, identity theft, and financial fraud spreading well past the original account tied to each login.

How "HQ Mixed" Combolists Get Assembled

A combolist is a compiled file of stolen login credentials, typically formatted as a URL, an email address, and a password, gathered from sources including older breaches and password-stealing malware. A "mixed" file pulls credentials from multiple sites rather than one, and marking it "HQ" signals to buyers that someone has already filtered out dead or incorrect entries before sharing it.

Check If You Are Affected

HEROIC's database includes more than 400 billion breached records, including verified combolists like this one. Run a free scan to check whether your email address and password appear in this file or any other breach on record.