U.S. Accounts Targeted: The X2190 HQ MIX Leak Exposed 2,189 Logins

What HEROIC Analysts Found

On July 15, 2026, HEROIC analysts identified a combolist file uploaded to a Telegram channel and labeled "X2190 HQ MIX." The file contained 2,189 records pairing email addresses with plaintext passwords and the website URLs those credentials were tied to, with the accounts inside overwhelmingly linked to U.S. based services and users.

Why This Is Dangerous

U.S. account holders are frequently targeted in files like this one because American accounts are often linked to major banks, mainstream shopping platforms, and widely used email providers, giving attackers a familiar and profitable set of targets. Because the passwords in X2190 HQ MIX are stored in plaintext and matched to specific site URLs, an attacker can begin testing these 2,189 logins immediately without any extra effort.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated website URLs

Why This Matters

Combolists focused on U.S. accounts feed directly into credential stuffing, where automated tools try each stolen email and password pair across other popular American websites and services. If you are one of the 2,189 people in this leak and you have reused a password on a bank, email provider, or online store, that account is now exposed to takeover. From there, an attacker can drain funds, hijack your email to reset other passwords, or use your information to commit identity theft.

How Combolist Leaks Work

A combolist pairs a username or email with a password, typically written as "email:password" per line, and is usually assembled from older breaches, malware infections, and previous leaks rather than one single new hack. Files like X2190 HQ MIX are often filtered or sorted by country because region-specific credential lists, especially ones tied to U.S. accounts, tend to be worth more and get used faster by criminals looking for a reliable target base.

Check If You Are Affected

If you think your email could be part of the X2190 HQ MIX leak or any other exposure, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. Run a free scan to see if your credentials appeared in this leak and find out which passwords to change.