The 11K Outlook Combolist Leak Exposed 10,785 Stolen Passwords

What HEROIC Analysts Found in the 11K Outlook Combolist Leak

In May 2026, HEROIC analysts identified a combolist titled "11K Outlook Combolist 05-22," uploaded to a Telegram channel by an anonymous user. The file contained 10,785 records of email addresses paired with plaintext passwords and the URLs those credentials were used on, with a focus on Outlook accounts.

Why This Is Dangerous

Outlook accounts are often the recovery email for other services, including banking, shopping, and social media logins. A plaintext password paired directly with an Outlook address gives an attacker not just access to that inbox, but a potential path into every other account tied to it through password reset links.

What Was Exposed in the 11K Outlook Combolist

• Email addresses (Outlook-focused)
• Plaintext passwords
• URLs of the associated websites

Why This Matters for the 10,785 Affected Accounts

With over ten thousand records in play, this leak is large enough to power an automated credential stuffing campaign. Anyone among the 10,785 affected accounts who reused their Outlook password elsewhere, or who relies on that inbox for password resets, faces a heightened risk of account takeover, identity theft, or financial fraud.

How an Outlook-Focused Combolist Gets Built

Attackers and list compilers often filter stolen credentials by email domain, in this case Outlook, because targeting one provider makes automated login attempts faster and more efficient. The result is bundled and dated, as this one was labeled "05-22," and shared through Telegram for others to use or resell.

Check If You Are Affected

If you use Outlook or any other email provider, HEROIC's free breach scanner can check your address against more than 400 billion leaked records, including combolists like this one. Run a scan now to see your exposure and secure your accounts.