How INDIA UHQ 22 uploaded by a Telegram User Leaked 98,911 Logins

HEROIC analysts uncovered a combolist titled "INDIA UHQ 22," uploaded to a Telegram channel on April 2, 2023. The file contained 98,911 records combining email addresses with plaintext passwords, along with the URLs of the accounts each pair unlocks.

How This Combolist Ended Up Online

Combolists like this one are usually built by combining data from several earlier password leaks, phishing pages, or infected devices into one large file, then shared or sold in dark web and Telegram channels. Once uploaded, the same file can be copied, resold, and redistributed indefinitely, which means a leak first compiled years ago can keep resurfacing and reaching new attackers long after the original theft.

What Was Exposed

• Email addresses
• Plaintext passwords
• Account URLs

Why This Matters

Because the passwords in this file are stored in plaintext, anyone who downloads it can use the credentials right away, no cracking or guessing required. If you have ever reused one of these passwords on another account, that account is now at risk too. Attackers rely on lists like this to run credential stuffing attacks, automatically trying each email and password pair across banking, email, and social media logins until they find one that still works, opening the door to account takeover, fraud, and identity theft.

How Combolists Work

A combolist pairs usernames or email addresses with matching passwords in a simple, searchable text file, stripped of anything that would slow an attacker down. The included URLs go a step further, telling criminals exactly which site each credential pair belongs to, so automated tools can target the right login page for every single record without any manual work.

Check If You Are Affected

With 98,911 credential pairs now circulating, checking your own exposure only takes a moment. HEROIC's free breach scanner searches more than 400 billion leaked records, including this combolist, so you can find out right away if your email and password were part of this leak and take action before someone else does.