500K Hotmails Dump: 514,968 Emails and Passwords Exposed

In November 2025, HEROIC analysts identified a stealer log advertised as "500k Hotmails" circulating on a Telegram channel. While the name rounds the total down for marketing purposes, HEROIC's analysis confirmed the exact count: 514,968 records, including email addresses, plaintext passwords, and the URLs tied to each login. As the name suggests, the majority of the addresses in this file are Hotmail and Outlook accounts.

Why This Is Dangerous

A dump built specifically around one email provider is dangerous because email accounts are often the master key to a person's digital life. Anyone who gains access to a Hotmail or Outlook inbox can use its "forgot password" links to reset logins for banking apps, shopping accounts, and social media, all without ever touching those services directly. With 514,968 plaintext email and password pairs in one file, an attacker has direct, ready-to-use access to over half a million inboxes.

What Was Exposed

This leak included the following data types:

• Email addresses (primarily Hotmail and Outlook accounts)
• Plaintext passwords
• URLs linked to each set of credentials

Why This Matters

Half a million exposed email accounts is exactly the kind of data that fuels large-scale credential stuffing and account takeover campaigns. Because a compromised email inbox can be used to reset passwords on nearly any other account tied to it, this single dump could cascade into stolen banking access, hijacked social media profiles, and identity theft for hundreds of thousands of people. The sheer size also means this data is likely to be resold, copied, and recirculated across multiple criminal channels for months or years.

How Stealer Logs Work

A stealer log is created by information-stealing malware, malicious software that infects a device through fake downloads, cracked software, or phishing emails. Once active, it pulls saved browser passwords, autofill data, and active sessions, then compiles them into a file. Dumps like this one are often filtered by email provider before being sold, since buyers frequently want lists focused on a specific service such as Hotmail, making the data easier to target for phishing and account takeover campaigns.

Check If You Are Affected

With 514,968 records in this single dump, the chances that your Hotmail or Outlook address is included are significant. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like this one, so you can find out in seconds and secure your inbox before an attacker uses it against you.