The ‘Hotmail Combo 1K’ Dump Actually Contains 1,178 Leaked Logins

In March 2026, HEROIC analysts found a combolist named "Hotmail Combo 1K" uploaded to Telegram on 14-Mar-2026. Despite the round-number name, the file actually contained 1,178 records pairing Hotmail email addresses with plaintext passwords and associated login URLs, more than the "1K" label suggests.

Why the Hotmail Combo 1K Dump Is Dangerous

Every password in this file is stored in plaintext, meaning anyone who downloads it can use the login immediately, with no cracking or guessing required. Each record already comes matched to its login URL, giving an attacker a ready-made path into 1,178 separate Hotmail accounts.

What Was Exposed

• Email addresses (Hotmail accounts)
• Plaintext passwords
• Account login URLs

Why This Matters

A Hotmail account often acts as the master key to someone's other accounts, since it is commonly used to verify identity and reset forgotten passwords on banking, shopping, and social media sites. If any of these 1,178 people reused the same password elsewhere, attackers can use credential stuffing to break into those other accounts too, leading to account takeover, identity theft, or financial fraud that starts with a single leaked email login.

How Combolists Like This One Work

A combolist is a plain text file of email or username and password pairs, gathered from phishing pages, malware-infected devices, or earlier breaches, then compiled and shared for free or resold on Telegram. Sellers frequently round the size of a batch in its name, as with this "1K" file that actually contains 1,178 records, since approximate labels are quicker to advertise than exact counts. These files circulate cheaply and widely, making them a steady source of account compromise.

Check If You Are Affected

If you use a Hotmail or Outlook address, or reuse that password anywhere else, it is worth checking whether your information appears in this leak. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can quickly find out and secure any exposed accounts before someone else does.