Hotmail.com Users at Risk: 1.3 Million Login Credentials Leaked Online

A Combolist Targeting Hotmail.com Accounts Surfaces Online

In June 2026, HEROIC analysts identified a large combolist focused on hotmail.com accounts circulating among Telegram users. The file contained 1,337,018 records, each pairing an email address with a plaintext password and the URL where the login was used, making it one of the largest dumps in this batch of breach data.

Why Targeting One Email Provider Makes an Attack More Efficient

By focusing on a single provider, attackers can build tools specifically tuned to that platform's login process, making automated attempts faster and more reliable. A dataset of this size, all tied to the same type of account, is exactly the kind of resource used to run large scale credential stuffing campaigns.

What Was Exposed in the Hotmail.com Leak

• Email addresses
• Plaintext passwords
• URLs tied to each credential pair

Why This Matters

With more than 1.3 million records involved, this leak gives attackers enormous scale to work with. Email accounts are often the key to resetting passwords on other services, so a compromised hotmail.com login can quickly lead to account takeover, identity theft, and financial fraud across other platforms tied to that inbox.

How a Provider-Specific Combolist Like This Gets Built

Attackers and data brokers often sort stolen credentials by email provider, pulling matching hotmail.com records out of multiple stealer logs and older breaches, then combining them into one large, focused file before distributing it through Telegram channels.

Check If You Are Affected

With over 1.3 million records involved, use HEROIC's free breach scanner to check your email against more than 400 billion leaked records, including this hotmail.com combolist, and find out if your password needs to change.