Analysts Flag Private Hotmail 9 Combolist Exposing 548 Accounts

HEROIC threat analysts observed a combolist named "private Hotmail 9" appear on Telegram on 12 June 2026. The file contains 548 records of email addresses, plaintext passwords, and associated URLs, gathered specifically around Hotmail accounts and marketed to buyers as "private," meaning it had not yet been widely redistributed at the time of upload.

Why the Private Hotmail 9 Leak Is Dangerous

Being labeled "private" makes this list more dangerous, not less. A combolist that has not yet circulated widely is more likely to still work, since victims have had less time to change their passwords. Combined with plaintext credentials and direct URLs, an attacker can move straight from download to login attempt on real Hotmail accounts with no extra steps in between.

What Was Exposed in the Private Hotmail 9 Combolist

• Email addresses
• Plaintext passwords
• URLs of the associated Hotmail accounts

Why This Hotmail-Specific Leak Matters

Hotmail and other webmail accounts are frequently used to recover access to banking, shopping, and social media logins. Anyone in this 548-record file who reused their Hotmail password elsewhere is exposed to credential stuffing and account takeover, and once an attacker controls the inbox itself, identity theft and financial fraud become far easier through password reset emails alone.

How "Private" Combolists Circulate

Sellers on Telegram often label fresh combolists as "private" to signal that the credentials are less likely to have already been changed, charging more for access before the file eventually leaks more broadly. The "9" in the name suggests this is one entry in a numbered series, indicating the same seller or group has released similar Hotmail-focused files before.

Check If Your Email Is In This Leak

If you use or have ever used a Hotmail account, it is worth checking your exposure now while this data is still fresh. HEROIC's free breach scanner searches more than 400 billion leaked records, so you can see in seconds whether your email appears in this leak or any other and secure your account before it is misused.