The Yahoo UHQ Base Leak Puts 47,859 Accounts at Risk of Fraud

HEROIC analysts identified a combolist marketed as 48k UHQ Yahoo Base that a Telegram user uploaded in January 2023. Despite the name, the file actually contains 47,859 records, just under the 48,000 advertised, pairing email addresses with plaintext passwords and the URLs where each credential was used. As with other UHQ, or ultra high quality, labels, this is a sales claim from the uploader rather than an independently verified rating. Why This Is Dangerous: Because the passwords in this file are stored in plaintext, anyone who downloads it can use the email and password pairs right away, with no cracking or decoding needed. What Was Exposed: - Email addresses - Plaintext passwords - URLs tied to each account Why This Matters: For each of the 47,859 accounts in this file, identity theft just got easier. An attacker with a working email and password pair can attempt credential stuffing against banking, shopping, and social media accounts, and can use details from the account to craft convincing phishing messages. The end result is often account takeover and financial fraud. How a Yahoo-Focused UHQ Combolist Gets Built: Criminals build lists like this by filtering a larger pool of harvested credentials down to accounts tied to a specific email provider, in this case Yahoo, then labeling the result with a quality claim like UHQ to attract buyers on Telegram and dark web forums. The underlying credentials still come from a mix of phishing pages, malware infections, and older leaks rather than one confirmed source. Check If You Are Affected: HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including combolists like this one. Run a scan to see if your credentials are part of this exposure and get clear steps to secure your accounts.