If You Reuse Passwords, the Mix HQ Part 2 Leak Is a Problem

In March 2023, HEROIC identified a stealer log titled Mix HQ Part 2 circulating on Telegram. This substantial dataset contains 99,783 records aggregated from multiple sources, each entry pairing an email address with a plaintext password and the URL of the service where it was used. The "HQ" designation indicates these are considered high-quality credentials by the cybercriminal community, meaning they have a higher likelihood of being valid and active.

Plaintext Passwords Require Zero Effort to Exploit

None of the 99,783 passwords in this collection are encrypted or hashed. They sit in the file ready for immediate use by anyone who downloads it. An attacker can scan through the entire list in minutes using automated tools, testing each credential against live services. If your password from this leak is still active on any account, you are one login attempt away from being compromised.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of websites and online services

Why Password Reusers Face the Highest Risk

The Mix HQ Part 2 dataset is specifically designed for credential stuffing attacks. Attackers take these nearly 100,000 email and password combinations and test them across every major platform: email providers, banks, social media, streaming services, and corporate portals. If you use the same password across even two accounts, a match in this dataset means both accounts are compromised. The mixed nature of this combolist means it covers credentials from diverse services, increasing the chance that at least one of your accounts is included.

Mixed Combolists and the Stealer Log Supply Chain

Mixed HQ combolists like this one are assembled from the output of infostealer malware running across thousands of infected devices. Multiple stealer log collections are merged, deduplicated, and filtered to create a curated set of high-value credentials. The malware that generates these logs infiltrates devices through phishing emails, fake software, and compromised websites, silently extracting every password saved in web browsers and applications before sending the data to command-and-control servers operated by cybercriminals.

Check If Your Credentials Were Exposed

HEROIC has catalogued over 400 billion compromised records from breaches and stealer logs around the world. Use the HEROIC breach scanner to check if your email address appears in the Mix HQ Part 2 dataset or any other known leak. Given the high-quality nature of this combolist, any match should be treated as an urgent security incident requiring immediate password changes across all your accounts.