The ’50k UHQ French Base’ Leaked 31,332 Logins, Not 50k as Advertised

HEROIC analysts identified a combolist named "50k UHQ French base" uploaded to a Telegram channel on January 5, 2023. Despite the "50k" in its name, the verified file actually contains 31,332 records, each pairing an email address with a plaintext password and the URL it was used on. HEROIC reports the confirmed count rather than the inflated number in the uploader's own title. Why This Is Dangerous: The file's own labeling, "UHQ" for ultra high quality, signals that the uploader curated these credentials specifically because they are believed to still work. Combined with the fact that each record already includes a working password, this lowers the effort required for an attacker to break into a real account. What Was Exposed: Email addresses. Plaintext passwords. URLs identifying the site or service each login belonged to, with the set apparently focused on French accounts based on the file's name. Why This Matters: Reused passwords are the biggest risk here. If someone in this file used the same password on their email, banking, or social media accounts, an attacker can test that single leaked password across multiple services through credential stuffing, turning one exposed login into several compromised accounts. How a Combolist Like This Gets Made: Files marketed as "UHQ" are typically compiled from stealer malware logs or phishing campaigns, then filtered and tested by the uploader to remove dead logins before being sold or shared, which is why sellers inflate the advertised count to make the file look more valuable than the working data actually supports. Check If You Are Affected: HEROIC's free breach scanner checks your email against more than 400 billion leaked records. If you have any connection to French services or accounts, run a scan now to confirm whether your credentials appear in this file.