UHQ Mix Combo Leaks 12,414 Logins, More Than a Small Town

12,414 Logins, More Than a Small Town's Worth of Accounts

HEROIC analysts identified a stealer log dataset called "UHQ Mix combo hqhotmailcomboowner" shared in a Telegram channel on December 16, 2024. To put the scale in perspective, 12,414 records is roughly the population of a small town, all sitting in one file as email addresses, plaintext passwords, and the login URLs tied to each account.

Why This Is Dangerous

Because the passwords in this dump are stored in plaintext, every one of these 12,414 credentials can be used immediately, with no cracking or decoding required. This is a "mix" combo list, meaning the accounts come from a variety of unrelated websites and services rather than a single company, which widens the range of accounts an attacker could try to access.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites tied to each login

Why This Matters

At this scale, automated credential stuffing tools can work through all 12,414 logins quickly, testing each one against banking, shopping, and social media sites to find accounts where the same password was reused. For the people in this file, the risk is not hypothetical: any account tied to the exposed email and password is a real target.

How Stealer Logs Work

A combo list this size is typically built up from multiple stealer log infections combined into one file. Info-stealing malware copies saved browser credentials from each infected device, and whoever compiles the final list merges those individual hauls together, sometimes under a branded name like "hqhotmailcomboowner," before sharing the combined result on Telegram.

Check If You Are Affected

With over 12,000 accounts in this single file, it is worth taking a moment to check your own exposure. HEROIC's free breach scanner searches more than 400 billion breached records, including combo lists like this one, so you can quickly find out whether your email address and password have been exposed.