HEROIC Analysts Found 18,481 Hotmail.com Passwords on Telegram

On July 12, 2026, HEROIC threat intelligence analysts detected a stealer log file circulating on Telegram that contained 18,481 records tied to hotmail.com accounts. The discovery revealed a substantial cache of email addresses, plaintext passwords, and URLs that expose the browsing behavior of thousands of Hotmail users.

Why 18,481 Hotmail.com Credentials in Plaintext Are a Major Threat

This is not a small or targeted leak. With 18,481 credential pairs available in plaintext, attackers have a ready-made toolkit for large-scale account compromise. Every record in this file contains a working email and password combination that requires zero effort to exploit. Criminals can log into Hotmail inboxes, access Microsoft-linked services, and use the stolen passwords to break into other platforms where victims reused the same credentials.

The browsing URLs bundled with each record add tactical value. They tell attackers exactly which banking sites, shopping platforms, healthcare portals, and other sensitive services each victim uses, allowing for precision-targeted attacks rather than random guessing.

What Was Exposed in the Hotmail.com Stealer Log

• Email addresses belonging to hotmail.com users
• Plaintext passwords readable by anyone with access to the file
• URLs cataloging the online services and websites visited by each user

Why This Scale of Exposure Demands Attention

At 18,481 records, this stealer log represents one of the larger single-file credential exposures affecting Hotmail users. Credential stuffing operations thrive on volume, and a dataset this size provides enough material to launch automated attacks across every major online platform. The success rate of these attacks typically ranges from 0.1% to 2%, which at this scale means dozens to hundreds of successful account takeovers from a single file.

The downstream consequences include unauthorized purchases, hijacked social media profiles, intercepted business communications, and stolen personal information that fuels identity theft and financial fraud.

How These Credentials Were Stolen

Stealer log malware operates as a silent data harvester on infected devices. Victims typically encounter it through phishing campaigns, trojanized software downloads, or malicious browser extensions. Once the malware gains a foothold, it systematically extracts saved login credentials from all installed browsers, along with cookies, autofill data, and browsing history.

The extracted information is compiled into structured files and exfiltrated to attacker-controlled infrastructure. These logs then enter a distribution pipeline through Telegram groups, dark web markets, and private criminal networks. The 18,481 records in this file likely represent data harvested from thousands of individual infected devices across a wide geographic area.

Check If You Are Affected

Hotmail remains one of the most widely used email services worldwide, and with 18,481 records exposed, the chances of finding your data in this leak are real. HEROIC maintains a free breach scanner backed by over 400 billion compromised records from known breaches globally. Search your email address to check whether your hotmail.com credentials have been exposed, and take immediate steps to change your passwords and enable multi-factor authentication.