One Upload, 2,379 Records: Inside the X2385 HQ Mix Combolist Leak

HEROIC analysts identified a combolist called X2385 HQ Mix, uploaded to a Telegram channel on August 6, 2026. In one single upload, the file delivered 2,379 records, each pairing an email address with a plaintext password and the URL confirming where that login works.

Why This Is Dangerous

One file, one upload, and thousands of working logins is all it takes for a combolist like this to circulate widely within hours. Because the passwords are stored in plaintext, anyone who downloads the file can start using the credentials immediately, with no cracking or extra effort required.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

A single combolist upload like X2385 HQ Mix can spread across dozens of Telegram channels and forums within a day, meaning the exposure window for the 2,379 accounts inside it starts the moment it appears. If you reused a password from an affected account elsewhere, attackers can use credential stuffing to break into your other accounts, leading to account takeover, financial fraud, and identity theft.

How Combolists Work

A combolist compiles email or username and password pairs, often gathered from stealer logs or older breaches, into a single file that criminals can act on right away. The "HQ," or high quality, label on this list signals that the credentials were curated or filtered before release, which usually means a higher proportion of the logins are still valid compared to an unfiltered dump of the same size.

Check If You Are Affected

With 2,379 records now circulating from this single upload, checking your exposure takes only a moment. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including combolists like X2385 HQ Mix, to tell you instantly if your email has been compromised. If you find a match, change that password everywhere you have reused it right away.