5.4 Million Yahoo USA Logins Leaked in UHQ Stealer Dump

HEROIC analysts identified a massive stealer log dataset named "5.500KK Yahoo USA base UHQ," uploaded to a Telegram channel on February 28, 2023. The "5.500KK" in the name reflects its true scale: the file contains 5,444,206 records combining email addresses, plaintext passwords, and the URLs of the sites those credentials were used on, with a focus on Yahoo accounts belonging to U.S. users.

Why This Is Dangerous

The label "UHQ," short for ultra high quality, signals that the seller has already screened these credentials and considers them reliable and working. Combined with plaintext passwords and exact login URLs, an attacker doesn't need to guess or crack anything. They can open the file and start logging into millions of Yahoo accounts immediately, with the seller's own claims vouching for the data's accuracy.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites the credentials were used on

Why This Matters

At a scale of 5.4 million records, the risk goes far beyond individual Yahoo inboxes. Email accounts are commonly used to reset passwords elsewhere, so attackers can pivot from a compromised Yahoo account into banking, shopping, and social media services. A dataset this large and marketed as high quality also makes automated credential stuffing especially effective, since bots can process millions of working logins in a short time.

How Stealer Logs Work

Stealer logs originate from infostealer malware that infects devices through phishing emails, pirated software, or malicious downloads, then silently harvests saved browser passwords, autofill entries, and active sessions. Criminals combine the output of huge numbers of individual infections into a single file, then filter and label it, as seen with the "UHQ" tag here, to market a premium, verified product to buyers on Telegram.

Check If You Are Affected

With 5.4 million Yahoo accounts caught up in this single leak, checking your exposure is one of the most important things you can do right now. HEROIC's free breach scanner searches a database of more than 400 billion exposed records to give you an instant answer and clear steps to secure your account.