UHQ Base Leak: 414,070 Accounts Are Ready to Steal

HEROIC's Dark Web intelligence operations uncovered a massive stealer log collection titled "2KK UserPass UHQ Base" that was distributed in March 2023. The dump contains 414,070 records, each linking an email address to a plaintext password and the URL of the service where it was captured. The "UHQ" (Ultra High Quality) designation signals that these credentials have been filtered for reliability — meaning they are considered highly likely to still work, making this dump an especially attractive resource for cybercriminals.

Plaintext and "Ultra High Quality": Maximum Danger

The 414,070 passwords in this dump are stored in plaintext and curated for quality. UHQ datasets are prized in underground markets because they undergo filtering to remove duplicates, dead accounts, and invalid entries. What remains is a concentrated set of working credentials that attackers can exploit with high confidence. This is not a raw dump — it is a refined weapon designed for maximum impact.

What Was Exposed

• Email Addresses — verified accounts spanning multiple email providers and services
• Plaintext Passwords — curated, high-quality credentials with high success rates
• URLs — the services and platforms where each credential pair was captured in use

414,070 Reasons Credential Stuffing Works

A UHQ credential set of this size is a goldmine for credential stuffing operations. Attackers load these pairs into automated tools and test them across banking sites, corporate email, social media, cloud platforms, and e-commerce stores. The "Ultra High Quality" filtering means the success rate per credential is significantly higher than average dumps. For victims who reuse passwords, a single entry in this dump means every account tied to that email and password is compromised.

How UHQ Stealer Logs Are Created

The data pipeline for UHQ bases starts with infostealer malware infecting devices across the globe. The malware harvests browser-stored credentials, session cookies, and form data, then transmits everything to attacker-controlled servers. The raw data is processed through automated validation tools that test each credential against the corresponding service. Only confirmed working pairs make it into the UHQ collection. This multi-stage process — infection, extraction, validation, and packaging — makes UHQ bases particularly dangerous because every entry has been verified.

Check If Your Credentials Were Exposed

HEROIC's breach scanner indexes over 400 billion compromised records from data breaches, stealer logs, and dark web sources. Search your email address to check whether your credentials appeared in the 2KK UserPass UHQ Base or any other known breach. Given the verified quality of this dump, finding your account here warrants immediate password changes across all your online services.