Abu Saud Cloud 10k Hotmail Combolist Exposes 10,514 Passwords

HEROIC analysts identified a combolist named "Abu Saud Cloud 10k Hotmail" that was uploaded to Telegram, tied to a leak dated 10 December 2024. The file contains exactly 10,514 records pairing Hotmail email addresses with plaintext passwords and the URLs those credentials were originally used on.

Why This Is Dangerous

Every password in this file is stored in plaintext, meaning an attacker can use each email and password pair immediately without needing to crack or decode anything. Because the list is focused on Hotmail accounts, a successful login can also expose whatever is connected to that Microsoft account, including Outlook email, OneDrive files, and other linked services.

What Was Exposed

• Hotmail email addresses
• Plaintext passwords
• URLs tied to the original login pages

Why This Matters

Lists like this one fuel credential stuffing, where attackers automatically test each stolen email and password pair against banks, shopping sites, and other email providers. With 10,514 records, even a modest reuse rate could translate into hundreds of successful account takeovers, opening the door to identity theft and financial fraud for the people affected.

How Combolists Work

A combolist is a plain text file of email and password combinations, typically pulled together from older leaks, phishing pages, or malware infections and then filtered by email provider before being shared. Filtering by provider, as this list does by isolating Hotmail accounts, lets an attacker target a specific type of account more efficiently instead of sorting through unrelated data.

Check If You Are Affected

Use HEROIC's free breach scanner to check whether your Hotmail address appears in this combolist or anywhere across HEROIC's database of more than 400 billion breached records. If your credentials show up, change that password immediately and enable two-factor authentication on your Microsoft account.