One File, 2,158 Records: The X2158 HQ Mix Combolist Leak

In late July 2026, HEROIC analysts identified a Telegram upload named X2158 HQ MIX, containing 2,158 records of email addresses, plaintext passwords, and the URLs tied to each credential pair. The file's name reflects its record count, HQ for high quality, and MIX indicating credentials pulled from multiple sources. Why is this dangerous? Every password in this file is stored in plaintext and paired with both an email address and the site it was used on, giving an attacker an immediate, ready-to-use set of login attempts. Because the file blends data from multiple sources, it can include accounts from a wide range of services rather than a single breached platform. What was exposed: email addresses, plaintext passwords, and URLs linked to each credential pair. Why this matters: mixed combolists like this one are commonly used for credential stuffing across many different platforms at once, since the accounts inside were not all pulled from the same source. That variety makes this kind of file useful to attackers targeting a broad range of victims rather than customers of just one company. How this combolist was built: mix combolists like X2158 HQ MIX are assembled by combining leaked credentials from several older breaches, phishing pages, and malware logs into a single file, then labeled with a record count and quality claim to attract buyers on Telegram. The blended nature of these files makes it harder to trace any single record back to its original source. Check if you are affected: with 2,158 accounts pulled from multiple sources, it is worth checking your exposure directly rather than guessing. HEROIC's free breach scanner searches your email address against more than 400 billion leaked records, including mixed combolists like this one, so you can secure any affected accounts right away.