The ‘22.546 Hotmail’ Leak Put 17,843 Password Pairs Online

In October 2024, a stealer log labeled "22.546 HOTMAIL" surfaced on Telegram. HEROIC analysts confirmed 17,843 exposed records in the file, made up of email addresses, plaintext passwords, and the URLs each login was used on.

Why the Label Overstates the Confirmed Count

The number in a file's name is usually a rough estimate made before the data is cleaned, and it often shrinks once duplicate entries and broken records are removed. HEROIC's confirmed figure of 17,843 records reflects the actual usable logins in this file, still tens of thousands of real Hotmail accounts with working passwords attached.

What Was Exposed

• Hotmail email addresses
• Plaintext passwords, stored with no encryption
• URLs identifying the exact login page each credential belongs to

Why This Matters

Nearly 18,000 working Hotmail logins gives attackers real scale to run automated credential stuffing campaigns, testing the same email and password combination across banking sites, shopping accounts, and social media. Anyone in this file who reused their Hotmail password elsewhere faces genuine risk of account takeover and financial fraud.

How a File Like This One Gets Compiled

Stealer malware infects individual devices, usually through cracked software or malicious downloads, and quietly records every username, password, and URL typed into a browser. To build a Hotmail-focused file like this one, the operator filters a larger batch of stolen logins down to a single email provider, then uploads the result to Telegram, where the estimated size often gets rounded up before anyone verifies the real number.

Check If You Are Affected

If you use a Hotmail account, it is worth checking your exposure now. HEROIC's free breach scanner checks your email address against a database of more than 400 billion breached and leaked records, so you can confirm in seconds whether your login was part of this file.