Leaked in Plaintext: 397 Hotmail Credentials from 400 Hotmail Hits

400 Hotmail Hits: 397 Webmail Logins Leaked on Telegram

In August 2025, HEROIC analysts identified a combolist named 400 Hotmail Hits, uploaded to Telegram by an anonymous user. Despite the name, the file actually contained 397 records pairing email addresses with plaintext passwords, along with the URLs each login was tied to. The listing focuses specifically on Hotmail-linked accounts, making it a targeted file rather than a random mix of credentials.

Why a Webmail-Focused Leak Is Dangerous

An email inbox is often the master key to someone's digital life. It is where password reset links land for banking, shopping, and social media accounts. Because these 397 passwords were leaked in plaintext, an attacker can log straight into the inbox, then use "forgot password" requests on other sites to take over accounts one by one, all starting from a single compromised email login.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs (the login pages tied to each account)

Why This Matters

Combolists that isolate a single webmail provider are especially useful for credential stuffing, since attackers know exactly what type of account they are targeting. Anyone in this file faces a heightened risk of account takeover, identity theft, and financial fraud, particularly because email access can be used to reset passwords on nearly every other service linked to that address.

How a Targeted Hotmail Combolist Gets Built

Sellers often filter larger stolen credential collections down to a single email provider, since buyers interested in webmail takeovers will pay for a focused list rather than sorting through a mixed batch themselves. The "400" in the name likely reflects the seller's original claim about the file's size, while the actual verified count came out to 397 records.

Check If You Are Affected

If you use a Hotmail or Outlook address, it is worth checking your exposure now rather than waiting. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including combolists like this one, so you can see if your email was part of this leak and secure it before someone else logs in first.