If You Reuse Passwords, the New HQ Part 2 Leak Affects You

A stealer log file titled "New HQ Part 2" surfaced on Telegram in January 2023, and HEROIC has confirmed it contains 100,086 credential records. Marketed as a "high quality" collection, the dump pairs email addresses with plaintext passwords and the URLs of websites where the credentials were actively used—all extracted from compromised devices by infostealer malware.

What Makes Plaintext Password Leaks So Dangerous

In many data breaches, passwords are at least partially protected by hashing. Not here. Every credential in the New HQ Part 2 dump is stored in plain, human-readable text. An attacker does not need any tools to decrypt them—they simply open the file and start testing logins. This removes the single biggest barrier that would otherwise slow down exploitation.

What Was Exposed

• Email Addresses – Account identifiers that also serve as targets for spear-phishing attacks
• Plaintext Passwords – Over 100,000 credentials stored without any encryption or hashing
• URLs – Specific websites and login portals where each credential was captured

Why Password Recyclers Are the Primary Victims

The label "HQ" in this dump stands for "high quality"—meaning these credentials have been verified or curated for higher success rates. If you have ever used the same password for your email, an online store, and a social media platform, a single valid entry from this list could compromise all three. Credential stuffing tools automate this process, testing each pair against hundreds of services in minutes.

Stealer Logs: Data Stolen Directly From Your Browser

These 100,086 records were not obtained from a corporate database breach. They were harvested one device at a time by infostealer malware—programs like Raccoon, RedLine, and Lumma that embed themselves through malicious downloads and phishing links. The malware reads saved passwords directly from your browser's credential store, captures cookies and autofill data, and transmits everything to the attacker. The resulting log files are then compiled into curated collections like New HQ Part 2.

Check If Your Credentials Were Exposed

One hundred thousand credentials is a substantial pool, and yours could be among them. HEROIC provides access to a breach scanner that covers over 400 billion compromised records from data breaches, stealer logs, and underground markets. Search your email address to find out whether you were affected by the New HQ Part 2 dump or any other known credential leak.