Attackers Harvest Sony Logins in Hotmail Combolist Leak

HEROIC analysts caught attackers circulating a combolist named hotmail 2 2_hits_sonyemail.sonyentertainmentnetwork.com on Telegram, dated 13-Dec-2024. Inside are 16 confirmed records, each a working Hotmail email and plaintext password pair harvested and matched against Sony Entertainment Network's notification system.

Why This Is Dangerous

Attackers who acquire this file do not need to work for access, the hard part is already done. Every one of these 16 credential pairs has already been tested and confirmed live, meaning a criminal can log directly into the matching Hotmail inbox and pivot into the linked Sony account within minutes.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to Sony Entertainment Network notifications

Why This Matters

Attackers harvest credentials like these specifically to run automated credential stuffing attacks across gaming, streaming, and financial platforms, betting that people reuse passwords. A Hotmail account tied to a Sony login can be used to reach stored payment cards or PlayStation Network access, opening the door to account takeover, identity theft, and financial fraud.

How Combolist Breaches Work

Attackers assemble combolists by feeding stolen credentials from earlier breaches through automated tools that test each pair against a chosen target, in this case Sony's account notification address. Only working hits, like these 16 records, survive the filtering process and get repackaged into files that attackers trade or sell on Telegram.

Check If You Are Affected

Attackers are actively testing lists like this one against real accounts right now, so waiting to check your exposure only gives them more time. HEROIC's free breach scanner searches more than 400 billion leaked records, letting you confirm in seconds whether your Hotmail login is exposed and needs to change immediately.