Our Analysts Found 6,155 Records in the 6k Hotmail Good Leak

HEROIC analysts found a combolist labeled "6k Hotmail Good" circulating on Telegram, tied to a leak dated 10 December 2024. The file contains 6,155 records pairing Hotmail email addresses with plaintext passwords and the URLs those accounts were used on. The word "Good" in the filename signals that the uploader claims these credentials were verified as still working at the time of posting.

Why This Is Dangerous

A combolist marked as verified is more dangerous than a random dump, since it tells attackers the passwords inside are likely to still log in. Combined with plaintext storage, that means anyone downloading this file can start testing accounts immediately with a higher chance of success than an unverified list.

What Was Exposed

• Hotmail email addresses
• Plaintext passwords
• URLs tied to the original login pages

Why This Matters

With 6,155 verified-working records, this list is well suited to credential stuffing, where attackers automate login attempts across banking, shopping, and other email platforms using the same password. Because these credentials were checked as active, the risk of account takeover, identity theft, and financial fraud is higher than with an unverified combolist.

How Combolists Work

A combolist is a plain text file of email and password pairs, typically assembled from older leaks, phishing pages, and malware infections. Some uploaders go a step further and run automated checking tools against the list before sharing it, labeling the results as "good" or "hits" to show which pairs still work, which is what appears to have happened here.

Check If You Are Affected

Use HEROIC's free breach scanner to check whether your Hotmail address appears in this combolist or anywhere across HEROIC's database of more than 400 billion breached records. If it does, change that password immediately and enable two-factor authentication on your Microsoft account.