The 2.7K HOTMAIL MOON Leak Exposed 2,678 U.S. Hotmail Accounts

HEROIC analysts identified a combolist titled "2.7K HOTMAIL MOON" uploaded to Telegram on January 11, 2026. The file contains 2,678 records tied to accounts based in the United States, each pairing an email address with a plaintext password and the URL the credentials were used with.

Why This U.S.-Focused Leak Is Dangerous

Because the list is concentrated on accounts tied to the United States, it's a compact, targeted resource for attackers running region-specific campaigns, from phishing emails written to match U.S. services to fraud attempts aimed at U.S. banks and retailers. With plaintext passwords already attached, there's no cracking required before the credentials can be tested.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each account

Why This Matters

Attackers frequently sort combolists by country or provider because it makes follow-up attacks, like phishing emails or fraudulent account resets, more convincing when they're localized. Anyone in this list whose password shows up elsewhere is exposed to credential stuffing, account takeover, and potentially financial fraud if payment details are linked to the compromised account.

How Combolists Like This Get Assembled

Lists like 2.7K HOTMAIL MOON are typically built by pulling credentials from older breaches or stealer logs and filtering them down to a specific provider or region, in this case Hotmail accounts based in the United States. That filtering makes the list more valuable to attackers targeting a specific audience, even though the overall record count is small.

Check If You Are Affected

If you use a Hotmail or similar email account, HEROIC's free breach scanner can check whether your address appears in this leak or any other, against a database of more than 400 billion compromised records. Run a scan and update your password if you get a match.