The HQ DATA Combolist Put 992 Stolen Email and Password Pairs Online

HEROIC analysts identified a combolist called HQ DATA that a Telegram user uploaded on July 4, 2026. The file contains 992 records pairing email addresses with plaintext passwords, along with the URLs of the accounts each login belongs to.

Why the HQ DATA Combolist Is Dangerous

Because the passwords are stored in plaintext, anyone who downloads this file can read the credentials right away, with no cracking required. Each record also includes the URL the login was taken from, so an attacker knows exactly which site to try each password on first, then moves on to any other account where the same password might work.

What Was Exposed in the HQ DATA Leak

• Email addresses
• Plaintext passwords
• URLs of the accounts the credentials belong to

Why This Matters for Anyone Reusing Passwords

Combolists like HQ DATA exist for credential stuffing, where attackers run each email and password pair against the matching site and other popular services in bulk. If a password from this leak was reused elsewhere, that account is exposed too. The likely outcomes are account takeover, identity theft, and financial fraud, especially for accounts linked to email, banking, or online shopping.

How a Combolist Like HQ DATA Comes Together

A combolist is a compiled file of email or username and password pairs, typically pulled from older breaches, stealer logs, or leaked databases and repackaged into one list. These files are commonly shared for free in Telegram channels before spreading to dark web forums, where attackers test the credentials against major websites to see which ones still work.

Check If You Are Affected

If you think your email or a password you use could be part of this leak, do not wait to find out. HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records, including combolists like HQ DATA, so you can see what has been exposed and update any reused passwords right away.