168,914 Plaintext Passwords Dumped in 170K Hotmail Combo Leak

HEROIC's threat monitoring systems identified a massive Hotmail-targeted credential dump titled "170K HOTMAIL COMBO" released by the operator hqhotmailcomboowner on Telegram in November 2024. With 168,914 records containing plaintext passwords, this represents one of the largest single Hotmail-focused stealer log releases in HEROIC's tracking database.

168,914 Passwords With Zero Protection

At nearly 170,000 records, the sheer volume of plaintext credentials in this dump is alarming. Every password is stored in readable form—no encryption, no hashing. Automated attack tools can ingest a file this size and begin testing credentials against live services within minutes. The scale means that even a small percentage of successful logins translates to thousands of compromised Hotmail and Microsoft accounts.

What Was Exposed

• Email Addresses — 168,914 Hotmail accounts linked to the broader Microsoft ecosystem
• Plaintext Passwords — a massive volume of unencrypted, immediately exploitable credentials
• URLs — service endpoints documenting where each credential was harvested

Large-Scale Credential Stuffing Against Microsoft Services

A Hotmail-specific dump of this size is a goldmine for credential stuffing operations. Attackers can systematically test 168,914 email-password pairs against Microsoft 365, Outlook.com, OneDrive, Azure, Xbox, Teams, and every other service tied to Microsoft accounts. The payoff extends further when victims reuse their Hotmail password for banking, shopping, or social media—each successful match opens another door. At this scale, attackers run enterprise-grade infrastructure to maximize the number of accounts they can compromise before victims change their passwords.

The hqhotmailcomboowner Operation

This is another release from hqhotmailcomboowner, a recurring operator who specializes in curating Hotmail credential collections from raw stealer log data. The operation follows a consistent pattern: acquire bulk stealer logs from infostealer malware campaigns, filter by Microsoft email domains, and release the results as branded combo lists on Telegram. At 170K records, this release represents significant operational capacity—likely drawing from thousands of malware-infected devices whose browser credentials were silently harvested and compiled into this single file.

Check If Your Credentials Were Exposed

With 168,914 Hotmail accounts in a single dump, the probability of your email being included is meaningful. Take action now by searching your email address in HEROIC's breach scanner, which contains over 400 billion compromised records. Determine in seconds whether your credentials appear in the 170K Hotmail Combo leak or any other known breach, and immediately update your password and enable multi-factor authentication on your Microsoft account and all connected services.