The HQ Mix Combo Neo3690 Leak Exposed 8,151 Accounts Worldwide

In January 2025, HEROIC's threat intelligence analysts identified a combolist uploaded to Telegram by an anonymous user, tracked as "HQ Mix Combo Neo3690 uploaded by a Telegram User." The file contains 8,151 records pairing email addresses with plaintext passwords and the URLs of the login pages those credentials belong to.

Why This Is Dangerous

The "HQ" in this file's name is combolist slang for "high quality," meaning the seller is advertising that the credentials inside are current and confirmed to work rather than stale or expired. Combined with plaintext passwords and the exact login URL for each of the 8,151 accounts, this file removes every obstacle standing between an attacker and a working login.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to each credential pair

Why This Matters

If your email address is among these 8,151 records and you've reused that password on another account, the exposure doesn't stay contained to one site. Attackers use working credential pairs like these to attempt logins across banking, shopping, and social media platforms, a technique known as credential stuffing, which can lead to account takeover, financial fraud, or identity theft.

How Combolist Leaks Work

A combolist bundles email and password pairs, typically formatted as email:password, often with the matching login URL attached so an attacker knows exactly where to use it. Sellers label their files with terms like "HQ" or "mix" to advertise quality and variety to potential buyers, then distribute or sell the file through channels like Telegram, where it can circulate widely before ever surfacing publicly.

Check If You Are Affected

The only way to know for sure is to check. HEROIC's free breach scanner searches more than 400 billion exposed records, including this leak, so you can see in seconds if your credentials are part of it and change your password before someone else uses it first.