How a Combolist Upload Exposed 1,961 Accounts: the x2075 HQ MIX Leak

What HEROIC Analysts Found

On July 24, 2026, HEROIC analysts identified a combolist file uploaded to a Telegram channel and labeled "x2075 HQ MIX." The file contained 1,961 records pairing email addresses with plaintext passwords and the website URLs those credentials were used on. The "HQ" tag in the name is commonly used in these circles to signal that the uploader considers the credentials high quality.

Why This Is Dangerous

Because the passwords sit in plaintext next to the exact site each one belongs to, anyone who downloads x2075 HQ MIX can start testing logins immediately with no cracking required. That direct, ready-to-use format is exactly what allowed 1,961 sets of credentials to go from a single Telegram upload to something usable by attackers within minutes.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated website URLs

Why This Matters

Combolists like x2075 HQ MIX exist specifically to feed credential stuffing, the process where automated tools try each stolen email and password pair against many other websites. If any of the 1,961 people in this leak reused a password on a bank, email account, or shopping site, that account is now exposed to takeover. From there, an attacker can drain money, hijack an email account to reset other passwords, or use stolen details to commit identity theft.

How Combolist Leaks Work

A combolist pairs a username or email with a password, usually written as "email:password" per line, and files like x2075 HQ MIX are typically assembled by pulling data from several older breaches, stealer logs, and previous leaks into one merged batch rather than coming from a single new hack. The uploader then labels and shares the finished file in a Telegram group, where it can be copied and reused by anyone who finds it, which is how a modest combolist ends up circulating widely with almost no barrier to entry.

Check If You Are Affected

If you think your email could be part of the x2075 HQ MIX leak or any other exposure, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. Run a free scan to see if your credentials appeared in this leak and find out which passwords to change.