1047x UHQ Hotmails Uploaded by a Telegram User: 1,047 Leaked Logins

In late June 2026, HEROIC analysts identified a small combolist file, titled '1047x UHQ Hotmails,' circulating in a Telegram channel after being uploaded by an individual user. The file contains 1,047 records pairing email addresses, mostly Hotmail and Microsoft accounts, with plaintext passwords and associated URLs. Why This Is Dangerous: Because every password in this file is stored in plaintext, anyone who gets a copy can use the credentials immediately, with no cracking or decryption required. Attackers typically load lists like this into automated tools that try each email and password pair against dozens of popular websites and services, a tactic known as credential stuffing. What Was Exposed: email addresses (largely Hotmail and Microsoft accounts); plaintext passwords; associated login URLs. Why This Matters: Even a combolist of just over a thousand accounts can cause real damage. If any of these 1,047 people reused their Hotmail password on other accounts, such as banking, shopping, or social media, an attacker can walk right in. Email accounts are especially high-value targets because they're often used to reset passwords elsewhere, meaning one compromised inbox can cascade into several account takeovers. How Combolists Work: A combolist is a compiled text file of email-and-password pairs, gathered from older breaches, phishing kits, or malware infections and repackaged for resale or free distribution. Telegram has become a popular place to share these files because it's fast, largely unmoderated, and reaches thousands of potential buyers instantly. This file looks like an amateur upload rather than the output of a large-scale hack, but the credentials inside are just as real and just as usable by attackers. Check If You Are Affected: You don't have to guess whether your email showed up in a leak like this one. HEROIC's free breach scanner checks your address against a database of more than 400 billion leaked records, including combolists like this, and tells you immediately if you're exposed. If you are, change the affected password right away, and anywhere else you reused it.