HEROIC Analysts Flag Hotmail Database Leak of 297,553 Records

HEROIC analysts flag a new stealer log listing named HOTMAIL_NEW_DATABASE_PRIVATE_TG_UP_KURZL0G_07_10_2025_15, uploaded to Telegram in October 2025 and containing 297,553 individual records tied mostly to Hotmail accounts.

Why This Is Dangerous

Hotmail and Outlook accounts often act as the master key to a person's online life. They are usually the recovery email for banking apps, social media, and work logins, so when a file focused specifically on Hotmail addresses starts circulating, the risk goes well beyond just one inbox. An attacker who gets in can reset passwords on nearly every other account tied to that address.

What Was Exposed

• 297,553 total records
• Email Addresses
• Plaintext Password
• URLs associated with each login

Why This Matters

Because the file is labeled "private," it may have been sold or shared in smaller, closed circles before reaching a wider audience, wich can mean fewer people are aware their information is out there compared to a loud, public breach. Victims often don't find out until suspicious activity shows up in their inbox or on a linked account.

How Stealer Logs Work

Databases like this one are compiled from infostealer malware running quietly on infected machines. The malware pulls saved usernames and passwords straight from the browser, focuses on email providers like Hotmail because of how valuable they are, then packages the haul for sale or free distribution on Telegram, exactly the kind of channel wehre this file surfaced.

Check If You Are Affected

If you use a Hotmail or Outlook address, it is worth checking sooner rather than later. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to tell you, in seconds, if your email shows up in a leak like this one.