225 Plaintext Passwords Dumped in Hotmail Hits Leak

HEROIC's DarkHive intelligence platform has identified a second Hotmail Hits stealer log, this one containing 225 compromised records and uploaded to Telegram in December 2024. Like its predecessor, this dataset contains verified Hotmail credentials — email and password pairs that have been confirmed as working logins by the threat actor who compiled the data.

No Encryption, No Protection, No Time to Waste

These 225 passwords sit in the file as raw, unencrypted text. Anyone who opens the dataset can read every password instantly. Unlike breaches where passwords are hashed — giving victims a window of time while attackers work to crack them — plaintext exposure means the clock starts ticking the moment the file is shared. Every second of delay in changing a compromised password is a second an attacker could use to log in.

What Was Exposed

• Email Addresses — Hotmail/Outlook accounts used across various services
• Plaintext Passwords — Readable credentials requiring zero effort to exploit
• URLs — The specific sites and services where these passwords were used

The Credential Stuffing Assembly Line

Even 225 credentials can cause widespread damage through credential stuffing. Automated attack tools rapidly test each email-password pair against banking platforms, cloud services, e-commerce sites, and enterprise applications. Studies show that credential stuffing success rates typically range from 0.1% to 2% — but when applied across dozens of services per credential, even a small dataset like this can yield multiple successful account compromises.

Inside the Infostealer Pipeline

This data was extracted by infostealer malware operating on victims' devices. These trojans — including variants like Stealc, Lumma, and RedLine — are engineered to extract credentials from browser password managers, capture form data in real time, and steal authentication cookies that allow session hijacking. The malware packages everything into log files, which are then sorted by email domain (in this case, Hotmail) and distributed through Telegram channels or dark web forums.

Check If Your Credentials Were Exposed

With over 400 billion compromised records indexed, HEROIC's free breach scanner can reveal whether your email or password appeared in this Hotmail Hits dump or any other known data breach. Search now, change any compromised passwords, and enable multi-factor authentication on every account that supports it.