Researchers Link the 1.700 Hotmail Dump to 1,753 Stolen Logins

HEROIC analysts identified a combolist labeled "1.700 HOTMAIL" that was uploaded to a Telegram channel on 18 October 2024. The file contains 1,753 records made up of email addresses, plaintext passwords, and the login URLs those credentials belong to.

Why This Is Dangerous

Named for the Hotmail accounts it targets, this combolist pairs each working email address with a plaintext password and the exact site it logs into. There is no encryption to break, an attacker holding this file can begin testing logins right away.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs for the associated accounts

Why This Matters

Anyone whose email and password appear among these 1,753 records is at risk of account takeover, particularly if that password has been reused on other sites. Attackers commonly run combolists like this one through automated tools that test each credential pair against email providers, banking sites, and social platforms, a tactic known as credential stuffing. Because email accounts are often used to reset passwords elsewhere, a compromised login can open the door to other accounts too.

How Combolists Work

A combolist pairs usernames or email addresses with passwords, one credential set per line, and is usually assembled by combining data from older leaks and stealer logs rather than a single company's breach. Combolists are often labeled by the email provider they target, as with this Hotmail-focused file, before being uploaded to Telegram channels for other users to test at scale.

Check If You Are Affected

To find out whether your email address or passwords appear in this combolist or any other leak, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records in just a few seconds.