How This 1K Hotmail Combolist Leaked 1,046 Passwords Online

HEROIC analysts found a combolist labeled "1K Hotmail" uploaded to Telegram on 20 August 2026, containing 1,046 records that pair Hotmail email addresses with plaintext passwords and the URLs those accounts were used on.

Why This Is Dangerous

This file did not come from a hack of Microsoft itself. It was compiled by pulling working Hotmail credentials from older leaks and malware infections, then packaged into one list and posted to a Telegram channel where anyone can download it for free. Because the passwords are already in plaintext, no additional work is needed before an attacker can start using them.

What Was Exposed

• Hotmail email addresses
• Plaintext passwords
• URLs tied to the original login pages

Why This Matters

Once a list like this circulates on Telegram, it gets picked up quickly by people running credential stuffing tools that test each pair against banks, email providers, and shopping sites. Reused passwords are the biggest risk here: one match can lead to account takeover, identity theft, or financial fraud well beyond the original Hotmail account.

How Combolists Work

A combolist like this is built by scraping and combining credential pairs from previous leaks, phishing pages, and infostealer malware, then sorting them by email provider, in this case Hotmail. The uploader posts the finished file to Telegram, where it can be downloaded, copied, and redistributed indefinitely.

Check If You Are Affected

Use HEROIC's free breach scanner to check whether your Hotmail address appears in this combolist or anywhere across HEROIC's database of more than 400 billion breached records. If it does, change that password immediately and turn on two-factor authentication for your Microsoft account.