2.3K Hotmail Combo List, Full Valid: 1,978 Records Leaked via Telegram

In June 2026, HEROIC analysts identified a file circulating on Telegram labeled a "2.3K Hotmail Combo List, Full Valid," containing 1,978 records of Hotmail account credentials. Unlike a raw, unverified stealer log, a combo list like this one has already been checked by whoever compiled it, meaning every email and password pair listed has reportedly been confirmed to still work. The file included email addresses, plaintext passwords, and the URLs of the login pages those credentials were tested against.

Why This Is Dangerous

The "Full Valid" label attached to this file is what sets it apart from a typical dump of old, possibly outdated credentials. It signals that someone has already tested each of the 1,978 logins and confirmed the password still works on the account, meaning an attacker does not need to guess which entries are real. With email, password, and login URL all included, whoever obtains this list can attempt to sign into each Hotmail account with almost no extra effort.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

A working Hotmail login is often the key to a person's entire online identity, since email inboxes are commonly used to reset passwords on banking, shopping, and social media accounts. Because this list has reportedly been verified as valid, the risk of account takeover is higher than with an unverified leak. Anyone whose credentials appear here faces a real chance of their inbox being accessed, their contacts targeted with phishing, or other accounts reset using that email address. Reused passwords compound the risk further, opening the door to credential stuffing across unrelated services.

How Combo Lists and Stealer Logs Work

Combo lists like this one are typically built from stealer log malware that infects a victim's device and silently records saved browser passwords, autofill data, and login sessions. Criminals then take those raw logs and run them through automated checking tools that attempt each login and flag which ones still work, producing a "full valid" list like this 1,978-record file. Because the checking step filters out dead or changed passwords, what remains is a smaller but far more dangerous set of confirmed, working credentials that get sold or shared on Telegram and dark web forums.

Check If You Are Affected

If you use a Hotmail or Outlook account, it is worth checking whether your credentials appear in this list or any other leak. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including verified combo lists like this one, so you can find out your exposure and change any at-risk passwords right away.