Users Targeted in the 94,127 Record MIX HQ SQLI Part 1 Breach

Users Targeted in the "MIX HQ SQLI PART 1" Stealer Log

In May 2023, HEROIC's threat intelligence team identified a stealer log shared on Telegram under the name "MIX HQ SQLI PART 1." The file contained 94,127 records, each pairing a victim's email address with a plaintext password and the URL of the login page that credential belonged to. Despite the "SQLI" label in its name, the underlying data is a stealer log, meaning it was harvested from infected devices rather than pulled from a single database.

Who Is Targeted and Why It's Dangerous

Every one of the 94,127 people in this file had their real login credentials copied directly from their own device, then packaged with the exact site those credentials unlock. There's no cracking or guessing involved for an attacker: the email, password, and URL arrive as a matched set, ready to use. Anyone whose data appears here is targeted the moment someone downloads the file and starts testing logins.

What Was Exposed in the MIX HQ SQLI Part 1 Log

• Email addresses for 94,127 individual victims
• Plaintext passwords, stored without encryption
• URLs identifying the exact login page each credential pair unlocks

Why This Matters If You're One of the 94,127 Targeted Users

If your email and password combination appears in this file and you've reused that password on other accounts, an attacker can move from this login into your email, banking, or shopping accounts using the same credentials. That kind of pivot is how a single leaked password turns into broader account takeover and identity theft.

How a File Labeled "SQLI" Can Actually Be a Stealer Log

Uploaders in these communities often use labels like "SQLI" loosely, sometimes to describe how a portion of the data was originally sourced or simply to make a file sound more valuable to buyers. In this case, HEROIC's analysis confirms the file matches the pattern of a stealer log: information-stealing malware harvesting saved browser passwords and URLs from individual infected devices, later combined and labeled as "HQ" (high quality) before being shared on Telegram.

Check If You're One of the Targeted Users

The only way to know if you're among the 94,127 people affected is to check. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including stealer logs like MIX HQ SQLI Part 1, and tells you instantly if your email address is included. If it is, change that password right away, stop reusing it anywhere else, and turn on two-factor authentication wherever it's available.