Hotmail Users Targeted in the Hotmail Access_2 Leak of 2,600 Logins

HEROIC analysts found a combolist titled "HOTMAIL ACCESS_2," uploaded by a Telegram user and dated November 7, 2024. The file contains 2,600 records pairing email addresses with plaintext passwords, along with the URLs of the sites those credentials were used on, with the naming pointing specifically to Hotmail account access.

Hotmail Users Targeted in This Leak

Lists like this one are built specifically around a single email provider, meaning every one of the 2,600 records is likely tied to a Hotmail inbox. That matters because email accounts are often the key to resetting passwords on banking, shopping, and social media accounts, so a compromised Hotmail login can give an attacker a path into several other accounts belonging to the same person.

What Was Exposed in HOTMAIL ACCESS_2

• Email addresses
• Plaintext passwords
• URLs tied to each set of credentials

Why This Matters for the 2,600 Hotmail Accounts Involved

If your Hotmail address is among these 2,600 records, an attacker already has your password and can log in immediately since it is stored in plaintext. From there, they could use email access to intercept password reset messages for other accounts, opening the door to credential stuffing, account takeover, identity theft, or financial fraud well beyond the original Hotmail inbox.

How This Combolist Was Assembled

A combolist compiles login credentials, usually gathered through malware, phishing, or earlier breaches, into a single file of email and password pairs. Provider-specific lists like HOTMAIL ACCESS_2 are typically filtered out of larger collections because a single email provider's logins are easier to sell to buyers who specialize in targeting that platform. Files like this circulate on Telegram, where attackers test the credentials in bulk for working access.

Check If You Are Affected

With 2,600 Hotmail accounts tied to this leak, checking your exposure is worth doing now. HEROIC's free breach scanner searches your email against a database of more than 400 billion leaked records, including combolists like HOTMAIL ACCESS_2, so you can find out if you are affected and secure your inbox before someone else logs in.