136K Hotmail UK Combo: 130,166 Accounts Leaked, Act Now

136K Hotmail UK Combo: A Large Stealer Log Targeting UK Accounts

HEROIC analysts uncovered a stealer log dataset called "136K HOTMAIL UK COMBO" shared in a Telegram channel on November 18, 2024. The file contains 130,166 records, each pairing a Hotmail or Outlook email address with a plaintext password and the URL the login was captured from, with a specific focus on UK-linked accounts.

Why This Is Dangerous

This is a large, targeted list. With 130,166 plaintext credentials tied specifically to Hotmail and Outlook, attackers can run automated login attempts against Microsoft's services at scale, no password cracking needed. Because email accounts are used to reset passwords elsewhere, gaining access to one of these inboxes can quickly cascade into access over banking, shopping, and social accounts linked to it.

What Was Exposed

• Hotmail and Outlook email addresses
• Plaintext passwords
• Login URLs for each account

Why This Matters

At this scale, credential stuffing becomes highly efficient for attackers: automated tools can test all 130,166 logins against Outlook.com and other services in a short amount of time, flagging which ones still work. Anyone whose password has not changed since this data was captured is at direct risk of having their inbox, and everything tied to it, taken over.

How Stealer Logs Work

A combo list of this size is usually the product of many separate malware infections consolidated into one file. Info-stealing malware harvests saved logins straight from an infected device's browser, and criminals compiling lists like this one filter the results by email provider and region, in this case Hotmail and Outlook accounts linked to the UK, to create a more targeted, higher-value product for buyers on Telegram and dark web forums.

Check If You Are Affected

If you use a Hotmail or Outlook account in the UK, check your exposure now. HEROIC's free breach scanner searches more than 400 billion breached records, including large stealer logs like this one, so you can find out immediately whether your details are exposed and change your password before it is used against you.