The MIX UHQ Part 2 Dump: 59,955 Stolen Logins Hit the Dark Web

In February 2023, HEROIC analysts uncovered a large combolist named "MIX UHQ PART 2 0907" uploaded to Telegram. The file, labeled "UHQ" for "ultra high quality" by its uploader, contains 59,955 records of email addresses and plaintext passwords along with the URLs each pair was tied to.

Why This Is Dangerous

At nearly 60,000 records, this is one of the larger combolists HEROIC has tracked from Telegram sources. "UHQ" listings are typically marketed to other criminals as pre-checked, meaning the credentials inside are more likely to still be active than an unfiltered dump of the same size.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each login pair

Why This Matters

With almost 60,000 accounts involved, the risk of credential stuffing rises sharply. Attackers can automate login attempts across banking sites, email providers, and social platforms using each pair, and any password reused elsewhere gives them an easy path to account takeover.

How a "UHQ" Combolist Is Built

Sellers who label a list "UHQ" are signaling to buyers that the credentials have already been filtered through automated checking tools, with dead or duplicate logins removed. The remaining pairs, drawn from older breaches, phishing kits, and malware logs, are then split into numbered parts, such as "Part 2," and distributed across Telegram channels.

Check If You Are Affected

Search HEROIC's free breach scanner, which checks your email against a database of more than 400 billion leaked records, to see if you are one of the 59,955 accounts in this file, and change your password anywhere it has been reused.