399,792 Passwords From the 426K Mix UHQ Combolist Just Surfaced

In January 2023, HEROIC analysts identified a combolist file uploaded to a Telegram channel under the label "426K MIX UHQ." While the uploader's label rounded the file up to 426,000 records, HEROIC's analysis confirmed 399,792 actual records, each pairing an email address with a plaintext password and the URL of the account it belonged to. Why This Is Dangerous Even after accounting for the inflated label, this is still a large collection of working login pairs. Because the passwords are stored in plaintext and matched to specific website URLs, attackers can move straight to testing these credentials against real accounts, and against other sites where the same password may have been reused. What Was Exposed Email addresses Plaintext passwords URLs of the accounts tied to each credential pair Why This Matters With nearly 400,000 confirmed records, automated credential stuffing tools can run through this entire file against banking sites, email providers, and shopping platforms in a short amount of time. Anyone in this file who reused a password elsewhere faces a real risk of account takeover, financial fraud, or identity theft. How Combolist Breaches Work A combolist pairs email addresses or usernames with passwords, typically compiled from older breaches, stealer logs, and scraped login attempts. Sellers often label these files with rounded or inflated numbers, along with terms like "UHQ" (ultra high quality) to suggest the credentials are especially reliable, then trade them on Telegram channels and dark web forums. Check If You Are Affected HEROIC's free breach scanner checks your email address against more than 400 billion breached records, including large combolists like this one. Run a free scan today to see if your credentials were exposed.