The 3.2M HOTMAIL Combolist Gave Hackers 3,118,687 Login Pairs

Picture millions of email addresses sitting next to their passwords, ready to be tried one by one: that's the 3.2M HOTMAIL combolist HEROIC analysts reviewed after it was uploaded to Telegram on January 12, 2026. It contains 3,118,687 records of email addresses, plaintext passwords, and the URLs they unlock. The only way to know if you're affected is to scan your email.

Why a File Built Around One Email Provider Is Risky

A combolist organized around a single email service makes an attacker's job simpler, since every address in the file already shares the same login page. That means automated tools can run through all 3.2 million pairs against that one provider without wasting time on addresses that won't match.

What Was Exposed

• Email Addresses: confirms the account and gives attackers a name to target directly.
• Plaintext Password: already readable, so it can be tested the moment the file is opened.
• URLs: points straight to the login page each password pair was collected from.

Why This Puts More Than Email at Risk

A webmail inbox is often the recovery address for banking apps, shopping accounts, and social media. If an attacker logs in using one of these pairs, they can use password reset emails sent to that inbox to take over other accounts entirely, turning one leaked password into a chain of compromised services.

How a Combolist Like This Gets Put Together

Combolists built around a single provider are usually assembled by filtering a larger pool of leaked credentials down to addresses from that one service, then packaging them for resale. HEROIC analysts confirmed the pairs in this file are formatted for direct login attempts rather than pulled from an outdated, inactive source.

Is Your Inbox One of the 3,118,687 in This HOTMAIL Leak?

Scan your email to check if your address appears in this file or any other leaked dataset. If it does, change that password immediately, along with any other account using the same one, and set a unique password for each going forward. Check this for personal and work email alike, since both get swept into files like this one.