The UHQ Mix Part 2 Dump Contains Enough Stolen Logins to Fill a City

In May 2023, HEROIC analysts identified a combolist named UHQ Mix Part 2 0930 circulating on Telegram, containing 99,055 records of email addresses and plaintext passwords along with the URLs tied to each account.

Why This Is Dangerous

Labeled as "UHQ," short for ultra high quality, this file signals to buyers that the credentials inside have likely been verified as working logins rather than random, unchecked guesses. With 99,055 plaintext passwords already tied to specific URLs, attackers can move straight to testing these credentials against the sites they were pulled from.

What Was Exposed in the UHQ Mix Part 2 0930 Leak

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

A verified list of nearly 100,000 working logins is a serious resource for credential stuffing attacks, since attackers already know these credentials have a higher chance of success compared to unfiltered data. This significantly raises the risk of account takeover, identity theft, and financial fraud for anyone in the file who has reused a password across multiple sites.

How a Combolist Like This Works

A "mix" file like this one is built by combining credentials from multiple sources into a single collection, then testing them in bulk to filter out logins that no longer work. Being labeled "Part 2" suggests it is one installment in a larger, ongoing series being distributed by the same uploader, a common pattern for sellers who break large stolen datasets into smaller, more manageable releases.

Check If You Are Affected

With nearly 100,000 records in this batch alone, it is worth checking your exposure directly. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to tell you if your credentials have appeared in this or any other breach.