The UHQ Mix 3 Leak Holds More Records Than a Full NFL Stadium

What HEROIC Analysts Found

In April 2023, HEROIC analysts identified a combolist file labeled "UHQ Mix 3," uploaded to a Telegram channel. The file contained 90,284 records, more logins than could fill a large NFL stadium, pairing email addresses with plaintext passwords and the URLs of the sites those credentials belong to.

Why This Is Dangerous

The "UHQ" in this file's name stands for "ultra high quality," a label sellers use to mean the credentials have already been tested and confirmed to work. Combined with the site URL for each login and a plaintext password, this file gives anyone who downloads it a large, pre-verified list of accounts ready to try.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each login to the site it belongs to

Why This Matters

A file this size, and labeled as verified working logins, is exactly the kind of resource attackers use for large-scale credential stuffing campaigns. Because people frequently reuse passwords, a single working login can often be tried against email, banking, and shopping sites tied to the same person, multiplying the risk far beyond the original account.

How Combolists Work

A combolist is a compiled file of email or username and password pairs, typically pulled from earlier breaches, stealer logs, or leaked databases and merged into one package. A "UHQ" or "mix" label signals that the credentials were run through automated checker tools and confirmed to still work, making the list more valuable, and more dangerous, to whoever buys or trades it.

Check If You Are Affected

With more than 90,000 records in this file alone, checking your exposure is worth doing. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to tell you if your email address turned up in this leak or others.