454 Plaintext Hotmail Passwords Dumped on Christmas Day

HEROIC's threat monitoring systems identified a stealer log file labeled "Hotmail 25.12.2024" uploaded to Telegram on December 25, 2024. The file contains 454 credential records tied to Hotmail accounts, each stored with a plaintext password and the URL where it was captured. The timing of this release — Christmas Day — is strategic: attackers know that users are less likely to monitor their accounts during holidays, creating a wider window for exploitation.

No Encryption Means No Barrier to Account Access

The passwords in this file are completely unprotected. They are not hashed, salted, or encrypted in any way. Anyone who obtains the Hotmail 25.12.2024 file can read each password in plain text and immediately attempt to log into the associated account. For Hotmail credentials specifically, gaining access to the email inbox often serves as a gateway to resetting passwords on every other service linked to that address.

What Was Exposed

• Email Addresses — Hotmail accounts that may serve as primary or recovery email for other services
• Plaintext Passwords — stored in readable format, exploitable without any technical expertise
• URLs — the login pages and services from which the malware harvested each credential

How Credential Stuffing Amplifies a Small Leak

Even 454 records can cause significant harm through credential stuffing. Attackers use automated tools to test each email-password pair across banking, e-commerce, streaming, and social networking platforms. Because Hotmail addresses are frequently used as recovery emails, a single compromised inbox can grant attackers the ability to reset passwords and seize control of accounts on entirely separate services. The small size of this dataset does not diminish its destructive potential.

Infostealer Malware: The Source of Holiday Credential Dumps

This data was collected by infostealer malware operating on infected devices. Trojans such as Vidar, RedLine, and Aurora extract saved passwords from browsers, capture form-fill data, and steal session cookies. The holiday season often sees increased malware distribution as users download apps, click promotional links, and install gift-related software without the usual caution. The stolen credentials are then compiled into log files and uploaded to Telegram by threat actors seeking to monetize the data quickly.

Check If Your Credentials Were Exposed

If you have a Hotmail or Outlook account, verify whether your credentials were included in this Christmas Day dump. HEROIC's breach scanner searches more than 400 billion compromised records and can tell you in seconds whether your email or password has been exposed. Acting now — changing your password and enabling two-factor authentication — can prevent attackers from exploiting credentials that may have gone unnoticed during the holidays.