5,962 Passwords From the ‘New Hotmail Hit’ Dump Just Leaked Online

The "New Hotmail Hit" Combolist Exposed 5,962 Login Credentials

On January 7, 2025, HEROIC's threat intelligence analysts identified a combolist labeled "new Hotmail hit" being shared by a user on Telegram. The file contains 5,962 records, each pairing a Hotmail-style email address with a plaintext password and the URL of the login page it unlocks. Most of the affected accounts are tied to the United States.

Why This Is Dangerous

Calling a combolist a "hit" typically signals that the seller considers it a fresh, successful batch of working credentials. Every password in this file is stored in plaintext, meaning there is nothing to crack before it can be tried, and each record already includes the exact login URL it belongs to. That leaves an attacker with almost nothing to figure out, the email, the password, and the destination are all handed to them at once.

What Was Exposed in the New Hotmail Hit Dump

• Email addresses (Hotmail-style accounts)
• Plaintext passwords
• URLs linking each credential pair to its login page

Why This Matters at Nearly 6,000 Accounts

Almost 6,000 people could be affected by this single file. Email access alone can be used to reset passwords on other services, read private conversations, or impersonate the account owner to contacts. If any of these passwords were reused elsewhere, the risk extends into credential stuffing on banking, shopping, or social media accounts, which can lead to account takeover or financial fraud.

How a "Hit" Combolist Like This Comes Together

A fresh "hit" is usually built from stolen credentials gathered through phishing pages, malware infections, or older breaches, then tested to confirm which ones still work before being packaged as a new release. Sellers use terms like "new" and "hit" to signal to buyers that the list is recently checked rather than an old, partly dead file. Once packaged, lists like this are uploaded to Telegram channels or dark web forums, where they are shared or sold to anyone looking for working accounts.

Check If Your Email Was in the New Hotmail Hit Leak

You do not have to wonder whether you are one of the 5,962 people in this file. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including combolists like this one, and tells you immediately if you have been exposed. If you find a match, change that password right away, and anywhere else you used it too.