The Hotmail 3 Combolist Puts 113 Email Accounts at Identity Theft Risk

HEROIC analysts found a small combolist titled "hotmail 3" that was leaked on April 10, 2026 and later surfaced on a Telegram channel. The file contains 113 records pairing Hotmail and Outlook email addresses with plaintext passwords, along with the URLs those logins are tied to. Why This Is Dangerous: A hotmail-focused combolist targets one of the most widely used email providers in the world, and email accounts are usually the key to resetting passwords everywhere else. Because the passwords here are stored in plaintext, anyone who gets this file can try them immediately, no cracking required. What Was Exposed: - Hotmail and Outlook email addresses - Plaintext passwords - URLs tied to the accounts Why This Matters: Even with only 113 accounts involved, the consequences for those individuals can be serious. An attacker who gets into a Hotmail inbox can use "forgot password" links to take over banking, shopping, and social media accounts linked to that same email address, turning one leaked password into a much bigger identity theft or financial fraud problem. How a Combolist Like This Works: A combolist pairs email addresses or usernames with passwords, usually gathered from older breaches, phishing pages, or infected devices, then filtered down to a specific target, in this case Hotmail and Outlook accounts, and shared or sold on Telegram or hacking forums. Focusing on one email provider makes it easier for attackers to write automated tools that check the credentials in bulk. Check If You Are Affected: HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can quickly find out if your credentials appeared in this combolist or any other exposure.