Dark Web Intel: 10,564 Hotmail Logins Found on Telegram

HEROIC's dark web intelligence analysts flagged a combolist simply named "Hotmail," uploaded by a Telegram user in October 2025. The file contains 10,564 records pairing Hotmail email addresses with plaintext passwords, along with associated URLs. Files like this circulate through private Telegram channels dedicated to trading stolen webmail credentials, and this one represents a meaningful batch of exposed logins tied to a single email provider.

Why a Hotmail-Specific Dump Is a Serious Threat

Webmail accounts like Hotmail often serve as the recovery address for banking, shopping, and social media logins. An attacker who gains access to one of these 10,564 accounts can frequently use it to reset passwords on other services, turning a single compromised inbox into a gateway for broader account takeover. Because the passwords are stored in plaintext, no additional effort is needed to put these credentials to use.

What Was Exposed in the Hotmail Combolist

• Email addresses (Hotmail accounts)
• Plaintext passwords
• Associated URLs linking each credential to a login page

Why This Matters for the 10,564 People Affected

A file of this size is large enough to power serious credential stuffing campaigns, where automated tools test each email and password pair against banks, retailers, and other webmail-linked services. If your Hotmail login is among these 10,564 records and you have reused that password anywhere, you face real risk of account takeover, identity theft, and financial fraud.

How Dark Web Combolists Like This Get Assembled

To build a provider-specific combolist, attackers pull stolen credentials from phishing pages, malware infections, and older breaches, then filter the results down to accounts using a particular email domain, in this case Hotmail. HEROIC's dark web monitoring regularly surfaces files like this one as they are shared and resold across Telegram channels that specialize in webmail credentials.

Check If You Are Affected

To find out whether your Hotmail address appears in this file or any other breach HEROIC tracks, use HEROIC's free breach scanner. It checks your information against a database of more than 400 billion leaked records, so you can quickly see your exposure and secure your inbox before an attacker uses it against you.