The 12K Outlook Combolist Leak Means Someone Could Be In Your Inbox

A Telegram Combolist Exposed 11,834 Outlook Accounts

HEROIC analysts identified a combolist labeled "12K OUTLOOK Combolist 05-24" circulated by a Telegram user, containing 11,834 records of Outlook email addresses, plaintext passwords, and associated URLs. The file appears to target Outlook users specifically, with accounts tied primarily to the United States.

Why This Is Dangerous

An Outlook account is often the key to someone's entire digital life, since it can be used to reset passwords on banking, shopping, and social media accounts. Because the passwords in this combolist are stored in plaintext, anyone who gets the file can log straight into an account without cracking anything first. Paired with the listed URLs, an attacker knows exactly where to try each email and password combination.

What Was Exposed

• Outlook email addresses
• Plaintext passwords
• Associated website URLs

Why This Matters

Because Outlook accounts frequently double as a recovery email for other services, a compromised inbox can be used to reset passwords across a person's banking, shopping, and social accounts. Attackers use lists like this one for credential stuffing, trying the same email and password pair on dozens of other sites, which can quickly escalate into account takeover, financial fraud, and identity theft.

How This Outlook Combolist Was Built

A combolist is a plain text file that pairs email addresses with passwords, usually gathered from older breaches, phishing pages, or malware that steals saved browser credentials. Rather than coming from a single hack of Microsoft, a combolist like this one is typically assembled by combining Outlook logins found across multiple smaller sources. Telegram channels have become a popular place to share and sell these compiled lists to anyone willing to pay.

Check If You Are Affected

If you use Outlook or reuse the same password elsewhere, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including combolists like this one. Run a free scan today and change any passwords you have reused across accounts.