The Outlook UHQ Base Dump Actually Holds 1.2 Million Stolen Logins

HEROIC analysts identified a large file labeled 1.5kk Outlook UHQ Base Domain, tied to a leak dated February 21, 2023, circulating on Telegram. The verified count is 1,209,979 records, below the 1.5 million implied by the 1.5kk in the name, but still one of the largest single files in this batch. Each record pairs an email address with a plaintext password and the URL it unlocks. Why This Leak Is Dangerous: UHQ, or ultra high quality, means these Outlook credentials have already been checked and confirmed to work, and at more than 1.2 million records, this is a large-scale, verified list that attackers can run against other services with a high expected success rate. What Was Exposed: - Email addresses - Plaintext passwords - URLs showing which login page each credential pair accesses Why This Matters: An Outlook inbox is frequently the recovery address for banking, shopping, and social media accounts, so a working login from this dump can become the first domino in a much larger account takeover. With over 1.2 million verified records, this file is large enough to fuel credential stuffing campaigns against many other websites at once. How a Base Domain Combolist at This Scale Works: Sellers assemble base domain dumps by collecting Outlook credentials from stealer malware and phishing campaigns over time, running them through checker software to confirm which logins still work, and packaging the verified accounts into one large file that gets sold or shared in bulk on Telegram. Check If You Are Affected: Search your email in HEROIC's free breach scanner, which checks against more than 400 billion leaked records, to see if your Outlook account is among the 1.2 million exposed in this leak, and change your password and enable two-factor authentication if it is.