73,994 Passwords From Hotmail 4 Just Surfaced on the Dark Web

What HEROIC Analysts Found

In December 2022, HEROIC analysts identified a combolist file labeled "Hotmail 4," uploaded to a Telegram channel. The file contained 73,994 records pairing email addresses, largely tied to Hotmail and Outlook accounts, with plaintext passwords and the URLs of the sites those logins belong to.

Why This Is Dangerous

A Hotmail or Outlook inbox is often the master key to someone's online life. It is commonly used to receive password reset links for banking, shopping, and social media accounts. With the password stored in plain text and the login page identified, an attacker holding this file can sign in directly and start resetting other accounts from there.

What Was Exposed

• Email addresses (Hotmail and Outlook accounts)
• Plaintext passwords
• URLs linking each login to the site it belongs to

Why This Matters

Because email inboxes are the recovery point for so many other accounts, a compromised Hotmail or Outlook login can quickly turn into a much bigger problem than a single stolen password. Anyone whose credentials appear in this file should assume an attacker could use email access to reset passwords elsewhere, making this a strong candidate for credential stuffing and account takeover attempts.

How Combolists Work

A combolist is a compiled file of email or username and password pairs, usually gathered from earlier breaches, stealer logs, or leaked databases. This particular list was filtered down to a single email provider, which criminals often do so they can focus checker tools and phishing attempts on one type of account at a time.

Check If You Are Affected

If you use a Hotmail or Outlook email address, it is worth finding out whether your login shows up in this leak or any other. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, so you can check quickly and know if it is time to change your password.