The Hotmail 2FA Combolist Leaked in 2025: Emails and Passwords Exposed

HEROIC analysts identified a combolist file uploaded to a Telegram channel in January 2025, containing 9,249 records tied to Hotmail and other webmail accounts. The file includes email addresses, plaintext passwords, and associated login URLs, meaning the credentials inside are ready to use the moment someone downloads the list. Why This Is Dangerous: Because the passwords in this file are stored in plaintext, anyone who gets the file can log into the affected accounts immediately, no cracking or decryption required. If you use the same email and password combination anywhere else, an attacker can try that same pair against your other accounts within minutes. What Was Exposed: - Email addresses linked to Hotmail and related webmail services - Plaintext passwords - URLs showing where each credential pair was originally used Why This Matters: Combolists like this one are the raw material for credential stuffing attacks, where automated tools test stolen email and password pairs against banking sites, social media, and shopping accounts. Because these passwords were never hashed, every one of the 9,249 records is immediately usable by whoever holds the file, whether they bought it, traded it, or downloaded it for free on Telegram. How a Telegram Combolist Like This Works: Combolists are compiled from older breaches, phishing pages, and malware logs, then repackaged and redistributed on Telegram channels where cybercriminals trade stolen data. Unlike a single company getting hacked, a combolist mixes credentials from many sources, so victims often have no idea their information sits inside this specific file until it resurfaces months or years after it was first collected. Check If You Are Affected: HEROIC's free breach scanner checks your email address against more than 400 billion leaked records, including combolists like this one. Run a scan to see whether your credentials appear in this or any other breach, and change any reused passwords right away.