Hotmail 3 Leak Exposes 1,979 Plaintext Passwords Ready to Reuse

HEROIC analysts logged a combolist file named Hotmail 3 on January 13, 2026, containing 1,979 records made up of email addresses, plaintext passwords, and the URLs each login opens. Nothing in the file is encrypted or masked, every password reads exactly as the account owner typed it. The only way to know if your details are among them is to scan your email.

Why Readable Passwords Raise the Stakes

A plaintext password skips the step that normally slows an attacker down: there is no hash to crack and no guessing involved, the password simply works as is. That makes Hotmail 3 immediately usable by anyone who downloads it, not just a skilled hacker. Because passwords are so often reused, the same word or phrase sitting in this file could also open a victim's banking, shopping, or social accounts.

The Data Found in the Hotmail 3 File

• Email Addresses: gives attackers a verified contact to target with phishing or credential stuffing.
• Plaintext Password: usable for login the moment it is read, with no cracking required.
• URLs: points to the exact site each email and password pair is meant to unlock.

What Happens if a Password Like This Gets Reused

If someone reused their Hotmail 3 password on another account, an attacker can try the same combination there without ever touching the original service. Email accounts are the highest risk of all, since gaining access to one often unlocks password resets everywhere else tied to that address. Because this file is already confirmed, the danger is not hypothetical; the records can be tested against live sites right now.

How Combolists Like This One Get Built

A combolist is assembled from older leaks, malware logs, and other scattered sources, then combined into one file by whoever is trading it. It is not evidence that any single company's servers were broken into, it is a reused collection of logins. According to HEROIC analysts, the matching URLs are usually added after someone has tested which logins still work, which is why files like Hotmail 3 tend to list a working site next to each pair.

Is Your Password Sitting in the Hotmail 3 File?

The quickest way to find out is to scan your email, which checks it against Hotmail 3 and every other file HEROIC has indexed. If a match turns up, change that password immediately, and change it anywhere else you used it too. Scan both your personal and work email addresses, since combolists like this rarely separate the two.