The UHQ New 124 Dump: 500,000 Stolen Login Credentials Surfaced

In April 2023, HEROIC analysts identified a stealer log file labeled "uhq new 124" circulating among Telegram users, exposing 500,000 records. The data includes email addresses, plaintext passwords, and the URLs of the sites those credentials were used on, harvested directly from infected devices rather than stolen from a single company's servers.

Why This Is Dangerous

Because the passwords in this dump are stored in plaintext and paired with the exact web addresses they unlock, an attacker doesn't need to guess or crack anything. They can simply take an email, password, and URL combination and log straight into that account. When people reuse the same password across multiple sites, a single stolen combination from this file can unlock email, banking, shopping, and social media accounts all at once.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the accounts and services the credentials belong to

Why This Matters

Stolen credential sets like this one fuel credential stuffing attacks, where automated tools try the same email and password pair against hundreds of other websites. They also enable account takeover, where an attacker locks the real owner out of an account, and can be a starting point for identity theft or financial fraud if the compromised accounts include banking or payment services.

How Stealer Logs Work

A stealer log is generated by malware that infects a victim's computer, often through a fake download, cracked software, or malicious email attachment. Once installed, the malware quietly captures saved passwords, autofill data, and browser session details, then uploads everything to the attacker as a text file. These logs are then sold or freely shared in Telegram channels and dark web forums, exactly where HEROIC analysts found this one.

Check If You Are Affected

With 500,000 records in this single file, the odds that your email address is included are real. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like this one, so you can find out quickly whether your credentials have been exposed and need to be changed.