Good Italy Leak Means 3,219 Accounts Are Ready to Steal

HEROIC uncovered a stealer log file named "Good Italy HQHotmailComboOwner" circulating on Telegram, first uploaded in December 2024. The dataset contains 3,219 credential records targeting Italian Hotmail users. Every entry includes a plaintext password alongside the associated email address and the URL where the credential was captured, making this a turnkey resource for account theft.

Unencrypted Passwords Are an Open Invitation

The passwords in this file are stored in plain, readable text. There is no hashing algorithm to reverse, no encryption key to obtain. Any person who accesses the Good Italy HQHotmailComboOwner file can immediately attempt to log into the exposed accounts. For the 3,219 affected users, the window between exposure and exploitation is effectively zero.

What Was Exposed

• Email Addresses — primarily Italian Hotmail accounts used as primary login identifiers
• Plaintext Passwords — stored without any form of hashing or encryption
• URLs — the websites and online services from which each credential was harvested

Why These Credentials Fuel Automated Attacks

Credential stuffing tools can process thousands of email-password pairs per minute, testing each combination across banking, e-commerce, streaming, and social media platforms. Because the Good Italy file specifically targets Hotmail users, attackers gain access not just to the email accounts themselves but potentially to every service linked to those addresses — password resets, two-factor codes, and account recovery flows all route through the compromised inbox.

Stealer Logs: From Infected Device to Telegram Channel

This data was collected by infostealer malware — trojans like Vidar, Raccoon, or Aurora that infect devices through malicious downloads, fake software cracks, or phishing attachments. Once active, the malware harvests every credential stored in the victim's browser, along with cookies, autofill data, and session tokens. The stolen information is compiled into log files, organized by region or email provider, and distributed on Telegram under labels like "Good Italy" to signal verified, high-quality credential sets.

Check If Your Credentials Were Exposed

Italian Hotmail users should be especially vigilant following this leak. HEROIC's breach scanner searches more than 400 billion compromised records to tell you whether your email or password has appeared in this or any other known data breach. If your credentials are found, change your password immediately and enable two-factor authentication on every account tied to that email address.