The HQ MX TST LST Leak Means Someone Could Be in Your Accounts

In August 2026, HEROIC analysts identified a combolist labeled HQ MX TST LST 08.13, uploaded by a Telegram user, exposing 1,474 records of email and username and password credentials, along with the URLs those accounts belong to. Despite the cryptic name, the underlying data follows the same pattern as any combolist: working logins ready to be tested.

Why This Is Dangerous

If your account is one of the 1,474 listed here, someone else may already have the exact combination needed to log in. Each record pairs a plaintext password with an email address and the site it opens, meaning an attacker can go straight to the account without any extra effort.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the accounts tied to each login

Why This Matters

Even a list of under 1,500 records is enough to fuel credential stuffing against the exact accounts named in it. If a password from this file was reused on another site, an attacker can pivot into email, banking, or shopping accounts, opening the door to identity theft and financial fraud.

How Combolists Like HQ MX TST LST Are Built

A combolist is a compiled file of email or username and password pairs, usually gathered from older breaches, stealer logs, or leaked databases. Sellers frequently label and test smaller batches, sometimes marking them as sample or test lists before offering the full collection, which may explain the naming pattern here, then circulate them through Telegram channels for others to use.

Check If You Are Affected

This combolist is one of thousands feeding into HEROIC's database of more than 400 billion breached records. Use HEROIC's free dark web scanner to check whether your email address or passwords appear in this leak or any other exposure, and lock down your accounts before someone logs in first.