Inside the UHQ Private Combolist: How 526,644 Passwords Leaked

HEROIC analysts identified a combolist called 1.13 Million UHQ Private Combolist that a Telegram user uploaded, containing 526,644 records of email addresses, plaintext passwords, and the URLs those credentials were used on. The data traces back to February 2023, and "UHQ," short for "ultra high quality," is a label sellers use to advertise combolists they claim are cleaner and more accurate than typical scraped lists.

Why This Is Dangerous

A combolist marketed as UHQ, or ultra high quality, has usually been filtered and deduplicated so that nearly every entry represents a real, working email and password pair. That means an attacker working through this file of 526,644 records is far less likely to waste time on dead or duplicate credentials, making automated login attempts against banks, retailers, and other services considerably more efficient than with a raw, unfiltered dump.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

With more than half a million credential pairs in circulation, the odds that any individual reused a captured password elsewhere go up substantially. A UHQ combolist like this one is exactly the kind of resource attackers use to run large-scale credential stuffing campaigns, testing stolen logins against dozens of popular websites in the hope that a password was reused. Because this data dates back to 2023, some individuals may have since changed their passwords, but anyone who has not remains exposed today.

Inside the UHQ Combolist: How It Gets Built

A combolist is a plain text file of login pairs, typically formatted as email:password, drawn from sources like phishing pages, malware infections, and older breaches. Compilers who label a file "UHQ" have usually gone a step further than a typical combolist creator: they run automated checks to remove invalid entries, filter out duplicates, and sometimes verify that a sample of the credentials still logs in successfully. This extra curation is what makes a private UHQ combolist more valuable and dangerous than a raw, unverified list, and it is why files like this one are often sold rather than given away for free.

Check If You Are Affected

To find out if your email address appears in this combolist or in any other exposed dataset, run a free scan with HEROIC's breach checker. It searches more than 400 billion compromised records, giving you a fast way to see if a password you are using has already been leaked and needs to change.