INDIA UHQ 124: 98,835 Passwords Exposed in Telegram Data Leak

HEROIC Analysts Catalog a 98,835-Record Stealer Log Named "INDIA UHQ 124"

HEROIC's dark web monitoring team identified a stealer log named "INDIA UHQ 124," uploaded to a Telegram channel on 02-Apr-2023. The file contains 98,835 records, each pairing an email address with a plaintext password and the URL of the site the credentials were captured from.

Why the INDIA UHQ 124 Stealer Log Is Dangerous

This file is dangerous because it gives an attacker everything needed to log in without any extra work. Each record already ties a specific email and password to the exact website they unlock, so there's no guessing or password cracking involved. Because the passwords are in plaintext, anyone who obtains the file can read them instantly and start using them right away.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the websites where the credentials were used

Why This Matters

With nearly 100,000 working email and password pairs in one file, this data is built for account takeover, letting an attacker log directly into whichever account each record points to. It also drives credential stuffing: if you reused that same password on other websites, those accounts are at risk too, regardless of whether they appear in this specific file.

How Stealer Logs Work

Stealer logs come from malware that infects a device, quietly pulls saved passwords and active session data straight out of the browser, and sends it all back to whoever controls the malware. The output is a plain text file that lists exactly which login works on which website, harvested directly from the source. Files like "INDIA UHQ 124" are then packaged and traded on Telegram, which is exactly where HEROIC analysts found this one.

Check If You Are Affected

With close to 100,000 records in this file, there's a real chance your information is part of it. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like this one, and tells you immediately if you've been exposed. If you get a match, change that password right away and don't reuse it anywhere else.