The 20K UHQ VPN Dump Contains Exactly 20,642 Email and Password Pairs

What HEROIC Analysts Found in the 20K UHQ VPN Dump

On July 5, 2026, HEROIC analysts identified a combolist titled "20k UHQ VPN" after it was uploaded to a Telegram channel by an individual user. The file contains exactly 20,642 records pairing email addresses with plaintext passwords, along with the URLs of the VPN login pages those credentials belong to. The affected accounts are tied primarily to the United States.

Why This Is Dangerous

VPN accounts are meant to protect a person's privacy and secure their connection, so a stolen VPN login hands an attacker the opposite of what the service promises. Because the passwords in this file are stored in plaintext, anyone who obtains it can log in immediately, potentially routing their own traffic through someone else's paid account or accessing any billing details tied to it.

What Was Exposed in the 20K UHQ VPN Dump

• Email addresses
• Plaintext passwords
• URLs identifying the associated VPN login pages

Why This Matters

A dump of 20,642 credentials is large enough to run through automated credential stuffing tools that test each pair against banking sites, email providers, and other VPN or subscription services. Anyone in this file who reused their VPN password elsewhere faces a real risk of account takeover and unauthorized charges, and stolen VPN access itself can be resold or used to mask other criminal activity.

How a UHQ VPN Combolist Is Built

"UHQ," short for ultra high quality, is a label sellers use to signal that a combolist has been checked and confirmed to contain working logins, unlike raw, unverified dumps. Lists like this are usually built by testing email and password pairs pulled from older breaches against VPN services, keeping only the ones that still work, then packaging and sharing the results on Telegram.

Check If You Are Affected

If you use a VPN service or any other account, it is worth checking whether your credentials appear in this leak or another one. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, so you can quickly see your exposure and update any passwords you have reused.