One Stealer Log. 94,181 Records. The UHQ USA 1 Credentials.

HEROIC analysts identified this stealer log on 02-Apr-2023. The breach exposed 94,181 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as UHQ USA 1 uploaded by a Telegram User.

Why This Is Dangerous

The UHQ USA 1 designation signals that this collection was curated for quality — UHQ (Ultra High Quality) means the credentials have been verified to work. With 94,181 confirmed active accounts targeting U.S. users, this log is especially attractive to criminals running credential stuffing attacks. Verified logins command premium prices on underground markets and are used immediately for financial fraud and account takeovers.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

A verified working credential is far more dangerous than a raw leaked password. Criminals who acquire UHQ logs know they can log in without first verifying their data. This accelerates the timeline of account takeover attacks, leaving victims less time to respond before accounts are drained or locked. U.S.-focused credential lists are especially valuable for targeting U.S. financial accounts and subscription services.

How Stealer Logs Work

Stealer logs are produced by infostealer malware distributed through phishing campaigns, malicious software cracks, and fake browser extensions. Once installed on a victim's device, the malware silently captures saved passwords, active login sessions, and browser-stored credentials. These records are compiled into log files, sorted by quality, and sold on dark web forums and private Telegram channels — with UHQ designations commanding the highest prices.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to find out if your credentials appear in this breach or others. Free, takes seconds.