US Accounts Exposed: 2.000 HOTMAIL Combolist Leak Details

HEROIC's threat intelligence team identified a combolist named "2.000 HOTMAIL" circulating on Telegram, dated October 19, 2024. The file contains 2,001 records linked to United States accounts, pairing email addresses with plaintext passwords and the URLs those logins belong to.

Why the 2.000 HOTMAIL Leak Is Dangerous

Because the passwords in this file are stored in plaintext, an attacker can immediately try each email and password pair against other websites. If any of these accounts share a password with an email or shopping account, that account can be accessed without any further effort.

What Was Exposed in the 2.000 HOTMAIL Combolist

• Email addresses
• Plaintext passwords
• URLs of the websites or services the credentials belong to

Why This Combolist Matters

Even a list of roughly 2,000 records is enough to fuel targeted credential-stuffing attempts, particularly against email providers like Hotmail, which many people use as the recovery address for other accounts. Taking over an email inbox this way can give an attacker the keys to reset passwords across a person's entire online life.

How a Combolist Like This Works

A combolist pairs usernames or emails with passwords, typically pulled from older leaks, stealer logs, or previous credential-stuffing runs, into one file. Lists like this one, focused on a specific email provider, are traded on Telegram and dark web forums because attackers can target one login system at a time with automated tools.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against more than 400 billion leaked records, including combolists like 2.000 HOTMAIL. If you find a match, change that password immediately, especially if it is also used on your primary email account.