How the X1528 HQ MIX Telegram Dump Leaked 1,519 Passwords

How the X1528 HQ MIX Combolist Came Together

On July 19, 2026, HEROIC analysts tracked a file called "X1528 HQ MIX" as it began circulating on Telegram. The dump contains 1,519 records, each combining an email address or username, a plaintext password, and the URL the login was used on. The "HQ" in the name is common shorthand in these channels for "high quality," meaning the uploader claims the credentials are verified and working.

Why This Is Dangerous

Because the passwords in this file were never hashed or encrypted, they are usable the moment someone downloads them. An attacker does not need to run cracking software or wait for a decryption breakthrough. They can immediately load all 1,519 email and password pairs into automated tools and start testing them against other websites within minutes of the file appearing online.

What Was Exposed in the X1528 HQ MIX Dump

• Email addresses and usernames
• Plaintext passwords (not hashed or encrypted)
• URLs tied to each login

Why This Matters for Anyone in the Dump

Files marketed as "HQ" or "mix" combolists are built specifically for credential stuffing, the practice of testing stolen logins across many sites at once. If your email is one of the 1,519 records in X1528 HQ MIX, and you reuse passwords across accounts, this single file could open the door to account takeover, identity theft, and financial fraud well beyond wherever the password first leaked.

How Combolists Like This One Are Assembled

A "mix" combolist like X1528 HQ MIX is typically built by combining credentials from several earlier sources, other leaked databases, phishing campaigns, and stealer malware logs, into one merged file. The uploader filters out duplicates and dead logins, labels the result "HQ," and distributes it to build a reputation for supplying working credentials in Telegram trading channels.

Check If You Are Affected

Rather than wonder whether your email address ended up in the X1528 HQ MIX dump, check directly. HEROIC's free breach scanner searches more than 400 billion leaked records, including combolists like this one, so you can see your exposure in seconds and change any password you have reused elsewhere.