Inside the 3.5k Hotmail Dump: 2,965 Real Email Accounts Exposed

In June 2025, HEROIC analysts found a combolist named "3.5k HOTMAIL" uploaded by a Telegram user. Despite the name suggesting a larger count, the file actually contained 2,965 usable records, each pairing an email address with a plaintext password and a source URL.

Why This Is Dangerous

Hotmail and Outlook accounts are frequently used to recover other online accounts. A working password gives an attacker a direct path into someone's inbox, where they can find password reset emails, personal documents, and enough information to take over connected accounts.

What Was Exposed in the 3.5k Hotmail Leak

• Email addresses
• Plaintext passwords
• Source URLs

Why This Matters

Because email accounts sit at the center of most people's digital identity, a single leaked Hotmail login can lead to account takeover across banking, shopping, and social media, especially if the password was reused. That chain reaction is exactly what identity thieves and fraudsters look for.

How a Combolist Attack Works

Combolists like this one gather stolen email and password pairs from breaches and malware, packaging them for easy reuse. Attackers feed the list into automated tools that test each pair against Hotmail, Outlook, and other services, quickly identifying which of the 2,965 accounts still have valid logins.

Check If You Are Affected

Use HEROIC's free breach scanner to check your email against more than 400 billion leaked records, including this Hotmail combolist. If you find a match, change your password immediately and avoid reusing it on any other site.