The X2300 HQ MIX Leak Went Public With 2,295 Accounts Exposed

HEROIC analysts identified a combolist known as X2300 HQ MIX that a Telegram user uploaded on 22 July 2026. The file contains 2,295 records tied to accounts in the United States, including email addresses, plaintext passwords, and the URLs of the sites those credentials unlock. The leak surfaced only weeks ago and is already circulating in Telegram channels used to trade stolen login data.

Why This Is Dangerous

Because the passwords in this dump are stored in plaintext, anyone who downloads the file can read them instantly. No cracking or decryption is required. Paired with the matching email address and the URL of the original login page, an attacker has everything needed to log straight into an account, no guesswork involved.

What Was Exposed in the X2300 HQ MIX Combolist

• Email addresses
• Plaintext passwords
• URLs linked to the accounts

Why This Matters

Combolists like this one are a favorite tool for credential stuffing attacks, where automated scripts try each email and password pair across banking sites, email providers, and social media platforms. If you have ever reused a password across multiple accounts, one leaked combination can unlock several logins at once. That can lead to account takeover, unauthorized purchases, and identity theft if enough personal details fall into the wrong hands.

How a Combolist Like This Gets Built

A combolist is a compiled file of username or email and password pairs, usually pulled together from older breaches, phishing campaigns, or malware infections and repackaged for resale or free distribution. The URLs in this dump tell attackers exactly which site each credential belongs to, making it easier to automate login attempts at scale. These files are traded cheaply and often shared in Telegram groups within days of being compiled.

Check If You Are Affected

With over 400 billion compromised records in its database, HEROIC's free breach scanner can tell you in seconds whether your email address turned up in the X2300 HQ MIX combolist or any other leak. If it did, change that password everywhere you have reused it and turn on multi-factor authentication wherever you can.