4,748 Plaintext Passwords Dumped in UHQ Canada Base Leak

HEROIC identified a stealer log called 5k UHQ Canada Base that was uploaded to Telegram in December 2022. Containing 4,748 records focused on Canadian users, this dataset carries the "UHQ" (ultra-high quality) label, meaning the credentials have been filtered for accuracy and freshness. Each record pairs an email address with a plaintext password and the URL of the service where the login was stolen.

Plaintext Passwords With No Protection Whatsoever

The 4,748 passwords in this file are fully exposed in plaintext. There is no hashing, no salting, no encryption of any kind. Each password can be read and used directly, making this dataset immediately actionable for attackers who want to test credentials against Canadian banking, email, and retail services.

What Was Exposed

• Email addresses belonging to Canadian online service users
• Plaintext passwords stored without any cryptographic protection
• URLs of the specific Canadian and international services targeted

Credential Stuffing Hits Canadian Users Hard

When credentials targeting a specific country are grouped together, attackers can focus their efforts on region-specific services. Canadian banks, government portals, telecommunications providers, and retail platforms become prime targets. Password reuse amplifies the risk: a single leaked credential from this curated set can unlock access to multiple critical services for the same user.

From Malware Infection to Country-Targeted Stealer Log

Infostealer malware captures credentials from infected devices regardless of geography. However, threat actors often sort and repackage the raw stolen data by country to create focused attack datasets. The UHQ Canada Base is the result of this process: credentials harvested by malware, filtered to Canadian users, and distributed on Telegram for anyone seeking to exploit accounts in that region.

Check If Your Credentials Were Exposed

Canadian users should take this leak especially seriously, as the credentials have been specifically curated to target their accounts. HEROIC's breach scanner indexes more than 400 billion compromised records from around the world. Search your email address now to find out if your credentials appear in this or any other breach, and update your passwords before attackers have a chance to use them.