Researchers Trace the 20k Hotmail Combo HQ Dump to 20,425 Logins

HEROIC analysts examined a Telegram upload named 20k Hotmail Combo HQ and confirmed 20,425 individual records inside it, each pairing a Hotmail email address with a plaintext password and the login URL it was used on. The file was first circulated in November 2024 and continues to resurface in credential-trading channels. Why This Is Dangerous: The passwords in this file were stored in plaintext, which means there is no encryption standing between an attacker and a working login. Anyone who has the file can try each email and password combination directly against Hotmail, Outlook, or any other service the same person might use. What Was Exposed: - Email addresses - Plaintext passwords - Login URLs for each account Why This Matters: A dump of 20,425 working credentials is large enough to automate at scale. Attackers load lists like this into credential stuffing tools that quietly test each pair across dozens of other websites, looking for password reuse. When they find a match, the result can be a hijacked email account, stolen identity information, or direct financial loss if a connected payment account is reached. How a Combolist Like This Works: A "combo" file like this one is assembled by combining credentials from multiple smaller breaches or malware infections, then filtering for a specific provider, in this case Hotmail and Outlook addresses, before being labeled and re-uploaded for other criminals to buy or trade. The "HQ" branding in the name is a marketing tactic sellers use to suggest the data is fresher and more reliable than competing lists. Check If You Are Affected: Use HEROIC's free breach scanner to check your email address against more than 400 billion exposed records, including this one. If you find a match, change your password right away and anywhere else you reused it.