Analysts Found 99,456 Stolen Passwords in the UHQ MIX Part 3 Dump

HEROIC Analysts Found 99,456 Stolen Passwords in the UHQ MIX Part 3 Dump

In May 2023, HEROIC's threat intelligence team came across a stealer log circulating on Telegram under the name "UHQ MIX PART 3 1001." The file held 99,456 records, each pairing a victim's email address with a plaintext password and the URL of the login page that credential unlocked, and it is now cataloged in HEROIC's breach intelligence database.

Why a Password-and-URL Match Like This Is So Dangerous

Every entry in the UHQ MIX Part 3 1001 file gives an attacker three things at once: who the victim is, what their password is in plain, readable text, and exactly where to use it. There's no cracking, guessing, or extra research needed. That combination is precisely what automated login tools are built to exploit, letting a criminal test tens of thousands of real credentials against real websites in a very short amount of time.

What Was Exposed in the UHQ MIX Part 3 1001 Dump

• Email addresses for 99,456 individual victims
• Plaintext passwords, stored without encryption
• URLs identifying the exact login page each credential pair unlocks

Why This Matters If You've Reused a Password Anywhere

Password reuse is what turns a single leaked account into a much bigger problem. If your credentials appear in this dump and that same password protects your email, banking, or shopping accounts elsewhere, an attacker who logs into one account can often use it to reach the others. This is the mechanism behind most credential-stuffing attacks and a common early step toward identity theft.

How a Numbered "UHQ Mix" Dump Like This Gets Assembled

"UHQ" stands for "ultra high quality" in these circles, meaning the uploader claims the credentials are fresh and verified as working, not recycled from an old breach. Files like this are built from information-stealing malware running on thousands of infected devices, each one quietly copying saved browser passwords and the URLs they belong to. The results get combined, checked, and split into numbered parts, in this case Part 3, before being shared or sold across Telegram groups.

Check If You're Among the 99,456 Records in This Dump

The only way to know for sure is to check. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including stealer logs like UHQ MIX Part 3 1001, and tells you instantly if your email address is included. If you get a match, change that password right away, stop reusing it anywhere else, and turn on two-factor authentication wherever it's available.