5,703 Hotmail Logins Leaked, Could Unlock Other Accounts

6K Hotmail Stealer Log Exposes 5,703 Records

In July 2026, HEROIC analysts identified a stealer log file uploaded to Telegram, labeled by its uploader as a batch of Hotmail accounts, that exposed 5,703 records. The file surfaced on 22 July 2026 and contains email addresses, plaintext passwords, and the URLs those credentials were entered on, all pulled directly from infected devices.

Why This Hotmail Stealer Log Is Dangerous

Because the passwords in this dump are stored in plaintext and matched to the exact login URLs they were used on, an attacker does not need to crack or guess anything, they can log straight into the Hotmail or Outlook account it belongs to. And a compromised email account is rarely the end of the story.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs associated with the logins

Why This Matters

Email inboxes like Hotmail are often used as the recovery address for banking apps, social media, and shopping accounts. If an attacker takes over one of these 5,703 accounts, they can use password reset emails to chain their way into other services the person owns, turning a single leaked login into access across someone's entire digital life. Anyone who reused this password elsewhere faces the same risk directly through credential stuffing.

How Stealer Logs Work

Stealer logs come from infostealer malware, which infects a device, often through a phishing link or fake download, and quietly copies everything saved in the browser: usernames, passwords, cookies, and autofill data. Criminals then bundle that stolen information into a log file, sometimes sorted by email provider as with this Hotmail-focused batch, and sell or trade it on Telegram channels and dark web forums.

Check If You Are Affected

To find out if your information is part of this leak or any other, run HEROIC's free breach scanner. It checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one, so you can quickly see if your credentials need to be changed.