The 16K Outlook Combolist Leaked in May, Surfaced Two Months Later

The data in this file was leaked back on 19 May 2026, but HEROIC analysts did not catch it circulating on Telegram until late July, weeks after it first appeared. The combolist, labeled 16K Outlook Combolist 05-04, contains 15,708 records pairing email addresses with plaintext passwords, along with the URLs those credentials were used on.

Why the Delay Between Leak and Discovery Matters

Every week a leak like this circulates unnoticed is another week attackers have to use it before the people affected even know it exists. Because the passwords in this file are stored in plaintext and matched to Outlook accounts, anyone who found this file in May has already had months to try these credentials on Outlook itself and on any other site where the same password might have been reused.

What Was Exposed in the 16K Outlook Combolist

• Email addresses
• Plaintext passwords
• URLs linked to each set of credentials

Why This Matters for the 15,708 People Affected

A file of this size is exactly what criminals use for credential stuffing, feeding thousands of email and password pairs into automated tools that test them against Outlook, banking, and shopping sites. The longer this data sits unnoticed, the more chances attackers have had to exploit reused passwords, putting affected accounts at risk of takeover, financial fraud, or identity theft.

How a Combolist Like This One Circulates Before It Is Found

A combolist is a plain text file pairing usernames or emails with passwords, usually gathered from older breaches, phishing pages, or malware infections and repackaged for distribution. Files like this one often move quietly through private Telegram channels for weeks or months before they are spotted by security researchers, which is exactly why HEROIC continuously monitors these channels for new leaks like the 16K Outlook Combolist.

Check If You Are Affected

If you use Outlook or think your email address could be part of this leak, HEROIC's free breach scanner checks your information against a database of more than 400 billion exposed records. Run a scan now to see whether your credentials have appeared in this leak, and change any reused passwords right away.