Steam and Valorant Logins Exposed in 57,760-Record UHQ Combo Leak

In March 2023, HEROIC analysts identified a stealer log advertised as "63k UHQ userpass Combo, Valorant, Steam, etc." circulating on a Telegram channel. Despite the name suggesting 63,000 entries, HEROIC's analysis confirmed 57,760 verified records in the file, including email addresses, plaintext passwords, and the URLs each login was tied to. As the name implies, many of the accounts in this combo are tied to gaming platforms like Valorant and Steam.

Why This Is Dangerous

Gaming accounts are often overlooked as a security risk, but they carry real value. Steam and Valorant accounts can hold linked payment methods, purchased games, in-game items, and skins worth real money, all of which an attacker can access instantly using the plaintext email and password pairs in this file. Because the "UHQ" label means the list has likely been checked for working logins, an attacker does not need to test which accounts are still active before attempting to take them over.

What Was Exposed

This leak included the following data types:

• Email addresses
• Plaintext passwords
• URLs linked to each set of credentials, including gaming platforms like Valorant and Steam

Why This Matters

With 57,760 verified email and password pairs, this combo is well suited to credential stuffing attacks that go far beyond gaming. Because people frequently reuse the same password for their email, banking, and gaming accounts, a login stolen from a Steam or Valorant account can just as easily unlock a victim's inbox or financial accounts. On the gaming side specifically, stolen accounts are often resold for their in-game inventory or used to commit fraud through linked payment cards.

How Stealer Logs Work

A stealer log is generated by information-stealing malware, malicious software often bundled with cracked games, cheats, or pirated software, which is a common infection route for gamers specifically. Once installed, it extracts saved browser passwords, autofill data, and active sessions from the device, then compiles them into a file. "UHQ" combos like this one are usually curated from multiple stealer logs, checked for working credentials, and sorted by platform, which is why gaming-specific combos such as this Valorant and Steam list are common products on Telegram.

Check If You Are Affected

With 57,760 verified records in this combo, gamers and non-gamers alike should check their exposure. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs and combo lists like this one, so you can find out quickly and secure any accounts that share a reused password.