The 50K Mixed Userpass HQ Dump Put 48,333 Stolen Login Pairs Online

What HEROIC Analysts Found in the 50K Mixed Userpass HQ Dump

On July 11, 2026, HEROIC analysts identified a combolist titled "50K Mixed Userpass HQ" after it was uploaded to a Telegram channel by an individual user. The file contains 48,333 records pairing email addresses with plaintext passwords, along with the URLs of the sites those credentials belong to. Despite the name, the actual count is just under 50,000 records, tied primarily to accounts in the United States.

Why This Is Dangerous

With 48,333 plaintext email and password pairs in one file, an attacker does not need any special skill to cause harm. The passwords are already readable, so the only work left is matching them against other websites. At this scale, even a low success rate still means thousands of accounts could be taken over.

What Was Exposed in the 50K Mixed Userpass HQ Dump

• Email addresses
• Plaintext passwords
• URLs identifying the associated login sites

Why This Matters

A dump of this size is exactly what automated credential stuffing tools are built for. Attackers feed all 48,333 pairs into scripts that test them against banks, email providers, and online retailers within minutes. Anyone in this file who reused a password across multiple accounts is at risk of account takeover, unauthorized charges, and identity theft, since one working password can unlock several unrelated services.

How a Mixed Userpass Combolist Like This Is Built

A "mixed userpass" file like this one is typically assembled by combining email and password pairs pulled from many different sources, older breaches, phishing kits, and malware infected devices, rather than a single hacked website. That mix is exactly why it can affect people who use dozens of unrelated sites. Once compiled, the list is shared or sold in Telegram channels where it can be downloaded and used immediately.

Check If You Are Affected

With tens of thousands of records in this leak alone, checking your exposure is a quick and worthwhile step. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, so you can see if your email and password appear in this dump or any other, and update your credentials before someone else does.