The 512X SUHQ Hotmail Access Leak Surfaced Two Months Ago

In June 2026, HEROIC's threat intelligence analysts identified a combolist uploaded to Telegram by an anonymous user, tracked as "512X VALID SUHQ HOTMAIL ACCESS uploaded by a Telegram User." The file contains 512 records pairing Hotmail email addresses with plaintext passwords and the URLs of the login pages those credentials open, all marked "valid" to signal they had been tested and confirmed to work.

Why This Is Dangerous

The "valid" label matters here. It means whoever compiled this list already ran the 512 credentials through a checker to confirm the passwords still work, saving an attacker the trouble of guessing. Paired with plaintext passwords and the exact Hotmail login URL, this file hands out working access on a silver platter.

What Was Exposed

• Email addresses (Hotmail accounts)
• Plaintext passwords
• URLs linked to each credential pair

Why This Matters

Like most webmail accounts, Hotmail inboxes are often used to recover passwords for other services. If your Hotmail login is one of these 512 records, and you've reused that password on another account, an attacker could use the "forgot password" flow to hop from your email into your banking, shopping, or social media accounts. This leak surfaced roughly two months ago, which means it has already had time to circulate before landing in HEROIC's records.

How Combolist Leaks Work

A combolist bundles email and password pairs, typically formatted as email:password, sometimes with a URL attached to show exactly which login page each credential opens. Lists labeled "valid" have usually been run through automated checking tools that filter out dead logins, leaving behind only the credentials confirmed to still work, which is exactly what makes a small, curated file like this one dangerous despite its size.

Check If You Are Affected

If you use Hotmail or Outlook, it's worth checking your exposure now. HEROIC's free breach scanner searches more than 400 billion exposed records, including this leak, so you can see if your credentials are part of it and change your password before someone else uses it first.