The Hotmail Breach Happened in 2016. 233,208 Accounts Still Exposed.

HEROIC analysts identified a 2016 data breach tied to Hotmail that exposed 233,208 accounts. Unlike many breaches on this list, no passwords were involved. The compromised records consist of email addresses along with first and last names.

Why This Is Dangerous

Even without a password in the mix, this combination of data is valuable to attackers. Knowing someone's full name alongside their email address lets a scammer write a message that feels personal instead of generic, which is exactly what makes phishing emails convincing. A message that greets you by name and references your actual email account is far more likely to get a click.

What Was Exposed

• Email addresses
• First names
• Last names

Why This Matters

This breach did not expose passwords, so account takeover is not the immediate risk here. The real danger is what attackers can build with it: personalized phishing emails, fake account recovery messages, or targeted scams that reference your real name to appear legitimate. Combined with data from other breaches, this kind of information also helps build a fuller profile of a person for identity theft or fraud.

How This Database Breach Happened

This incident is classified as a database breach, meaning attackers gained direct access to a portion of Hotmail's stored account data rather than harvesting it one record at a time. Breaches involving basic profile fields like names and emails often happen through an exposed database, a misconfigured server, or a third party service that stored the same information. Once accessed, entire tables of records can be copied out in a single move.

Check If You Are Affected

If you have used a Hotmail account, it is worth checking whether your name and email address are part of this exposure. HEROIC's free breach scanner checks a database of more than 400 billion leaked records, so you can see instantly if your email address turns up and stay alert to phishing attempts that use your real name.