At Risk: COMBOIST 850K HOTMAIL FRESH 100 uploaded by a Telegram User

In April 2026, HEROIC analysts identified a combolist posted to Telegram under the name "COMBOIST 850K HOTMAIL FRESH 100," containing 395,955 exposed records. Each entry pairs a Hotmail email address with a plaintext password and the login URL it was captured from, filtered down from a much larger raw pool to the accounts confirmed to still be active.

How One Leaked Login Chains Into Bigger Risk

A Hotmail or Outlook account rarely stands alone. It is often the recovery address for banking apps, shopping accounts, and social media, and the inbox where password reset links land. That means a single compromised Hotmail login in this file does not just expose email, it can hand an attacker the key needed to reset passwords on every other account tied to it, one leaked credential setting off a chain reaction across a person's entire online life.

What Was Exposed

• Hotmail email addresses
• Plaintext passwords
• Login URLs tied to each credential pair

Why This Matters

With nearly 400,000 confirmed working logins, this list is built for credential stuffing, automated attempts to try the same email and password combination across banking, shopping, and social accounts. Because email inboxes are the gateway to password resets everywhere else, a single exposed Hotmail login can escalate quickly into account takeover, identity theft, and financial fraud well beyond the original email account.

How an 850K Raw Pool Becomes 395,955 Fresh Hits

Sellers typically start with a large, unfiltered stealer log or combolist and narrow it down to accounts from a single email provider, in this case Hotmail. Each login is checked against the real service to confirm it still works, and only the confirmed hits are kept in the final "fresh" file, which is how a claimed 850,000-record source list was narrowed down to the 395,955 verified records here.

Check If You're Affected

Because a single compromised Hotmail login can chain into other accounts, checking your exposure matters more than it might seem. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, so you can see in seconds whether your email and password appear in this leak or any other.