1,043 Hotmail Logins Found With Passwords in Plain Text

Over a Thousand Hotmail Logins Stored in Plain Text

HEROIC analysts discovered a file named "HOTMAIL COMBO" uploaded to a Telegram channel on June 7, 2026. It contains 1,043 records, each pairing a Hotmail email address with its plaintext password and the URL the login was used on.

Why This Is Dangerous

The detail that stands out here is that every password in this file is stored as plain, readable text rather than being scrambled or hashed in any way. That means anyone who opens the file can read the exact password for each account, with zero technical skill required to use it.

What Was Exposed

• Hotmail email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

Plaintext passwords are as usable to a criminal as they are to the real account owner. With over a thousand Hotmail accounts exposed this way, attackers can log in directly, and if any of these passwords match ones used on other sites, the accounts become entry points for credential stuffing and account takeover across banking, shopping, and social media logins too.

How Plaintext Combo Lists End Up on Telegram

Data like this usually originates from information-stealing malware that copies saved browser passwords in whatever format they are stored, which is often plaintext for convenience. Sellers then compile these logs by email provider, in this case Hotmail, and share or sell the resulting combo list to buyers looking for a specific target.

Check If You Are Affected

If you have a Hotmail account, it is worth checking whether your login appears in this file. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including plaintext combo lists like this one, so you can act quickly if you are affected.