402 Fresh Hotmail Passwords From the 404x Dump Hit Telegram

In March 2026, HEROIC analysts identified a combolist labeled "404x FRESH HOTMAIL" uploaded to Telegram on 14-Mar-2026. Despite the batch name, the file actually contained 402 records pairing Hotmail email addresses with plaintext passwords and the associated login URLs.

Why the 404x Fresh Hotmail Combolist Is Dangerous

The "fresh" label on this file means the credentials were recently gathered rather than pulled from an old breach that victims may have already secured. Because every password is stored in plaintext, anyone who downloads the file can use the login immediately, with no cracking needed, and each record already comes matched to its exact sign-in page.

What Was Exposed

• Email addresses (Hotmail accounts)
• Plaintext passwords
• Account login URLs

Why This Matters

A Hotmail account is frequently the key used to verify identity and reset passwords on banking, shopping, and social media accounts, so a compromised inbox can spread damage well beyond email. If any of these 402 people reused their Hotmail password elsewhere, attackers can use credential stuffing to break into those other accounts too, opening the door to account takeover, identity theft, and financial fraud.

How Combolists Like This One Work

A combolist is a plain text file of email or username and password pairs, typically pulled from phishing pages, malware-infected devices, or older breaches and repackaged for resale or free distribution. Sellers often batch and label these files by size and freshness, as with this "404x FRESH" upload, to convince buyers the credentials are new and more likely to still work. These lists trade cheaply and widely on Telegram, making them a steady, low-effort source of account compromise.

Check If You Are Affected

If you use a Hotmail or Outlook address, or reuse that password anywhere else, it is worth checking whether your information appears in this leak. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can quickly find out and secure any exposed accounts before someone else does.