105 US Hotmail Accounts Exposed in the DARK HOTMAIL Leak

What HEROIC Analysts Found

On August 3, 2026, HEROIC analysts identified a combolist titled DARK HOTMAIL, uploaded by a Telegram user. The file is small compared to many leaks HEROIC tracks, just 105 records, but each one pairs an email address with a plaintext password and the URL of the account it belongs to.

Why a US-Focused Leak Like DARK HOTMAIL Is Still Dangerous

The records in this file are tied to United States accounts, and while 105 is a small number next to breaches that expose millions, every single one is a working login. An attacker only needs one match to get into an inbox, and from there, into whatever accounts that inbox controls through password resets.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs identifying the Hotmail-linked account for each entry

Why This Matters

Small leaks get less attention, which can make them more dangerous, not less. If your email and password appear among these 105 records and you have reused that password elsewhere, you're just as exposed to credential stuffing, account takeover, and fraud as someone caught up in a much larger breach.

How Combolists Work

A combolist pulls together email or username and password pairs, often from stealer logs, older breaches, or phishing, and groups them for a specific audience. DARK HOTMAIL appears to be a small, curated batch focused on US Hotmail users rather than a broad, indiscriminate dump.

Check If You Are Affected

Even with only 105 records in this particular file, it is worth checking. HEROIC's free breach scanner checks your email against more than 400 billion exposed records across every leak HEROIC has catalogued, including small combolists like DARK HOTMAIL, and tells you instantly if you need to act.