Our Analysts Found the UHQ MIX Combolist With 598,639 Logins

HEROIC analysts found a combolist named UHQ MIX PART 1 0923 circulating on Telegram, uploaded with a stated collection date of December 14, 2022. The file contains 598,639 records of email addresses, plaintext passwords, and the URLs each pair was collected from. Why This Is Dangerous: 'UHQ' is combolist shorthand for 'ultra high quality,' a label sellers use to signal that the credentials inside have been cleaned up and are more likely to still work. That marketing exists because it makes the file more attractive to buyers who want logins they can use right away, not stale data from years-old breaches. What Was Exposed: - Email addresses - Plaintext passwords - Source URLs for each credential pair Why This Matters: A file this size, nearly 600,000 credential pairs, gives attackers enormous reach for credential stuffing. They can automate login attempts across hundreds of websites at once, and any account where the password was reused becomes an easy target for account takeover, identity theft, or financial fraud. How This Combolist Was Assembled: 'Mix' files like UHQ MIX are typically compiled from multiple smaller breach dumps and stealer logs, sorted and deduplicated, then split into numbered parts, this one is labeled 'Part 1,' suggesting more of the same series may exist. The 0923 in the name likely refers to a batch or file number rather than a date, since the stated leak date predates it. Check If You Are Affected: HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including combolists like UHQ MIX, so you can quickly find out if your credentials were caught up in this exposure and secure your accounts before they're misused.