The HotmaiL.co.uk Combolist: 11,147 UK Email Logins Hit the Dark Web

HEROIC analysts found a combolist titled "HotmaiL.co.uk" that was leaked on March 29, 2026 and later surfaced on a Telegram channel. The file contains 11,147 records pairing Hotmail.co.uk email addresses with plaintext passwords, along with the URLs those logins connect to. Why This Is Dangerous: This combolist focuses specifically on the .co.uk version of Hotmail, meaning attackers can target UK-based email users with automated login attempts rather than wasting time on accounts that do not exist. Because the passwords are stored in plaintext, anyone who downloads the file can try them immediately. What Was Exposed: - Hotmail.co.uk email addresses - Plaintext passwords - URLs tied to the accounts Why This Matters: Email accounts are often the master key to a person's other online accounts, since most services use email to verify identity or reset passwords. If any of the 11,147 people in this file reused their Hotmail password elsewhere, an attacker could use it to break into banking, shopping, or social media accounts too, leading to account takeover, identity theft, and financial fraud. How a Combolist Like This Works: A combolist pairs email addresses with passwords, usually collected from older breaches, phishing pages, or infected devices, then filtered down by domain, in this case Hotmail.co.uk accounts, before being sold or shared on Telegram or hacking forums. Focusing on a single domain makes it easier for attackers to automate credential stuffing attempts against Hotmail's login page specifically. Check If You Are Affected: HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can quickly find out if your credentials appeared in this combolist or any other exposure.