US-Tagged Hotmail Combo_2 List Exposes 1,235 Logins

On November 28, 2024, a Telegram user uploaded a combolist named "Hotmail Combo_2," classified in HEROIC's tracking system with a United States origin tag. Analysts confirmed the file contains 1,235 records, each combining an email address, a plaintext password, and a source URL.

Why the US Classification Matters for Affected Users

Combolists tagged to a specific region are often used by attackers running localized campaigns, targeting banks, retailers, and services that are more common in that market. For the 1,235 people in this file, that means the follow-on attacks are more likely to involve US-based financial institutions and services rather than random international targets.

What Was Exposed in the Hotmail Combo_2 List

• Email addresses
• Plaintext passwords
• Source URLs tied to each credential

Why This Matters

Plaintext passwords require no cracking, an attacker can use them the moment the file changes hands. For anyone in this list who reused their Hotmail password elsewhere, especially on US banking or shopping sites, that reuse is exactly what credential stuffing attacks are built to exploit. A single successful login can lead to account takeover, unauthorized purchases, or a locked-out inbox.

How Region-Tagged Combolists Get Built

Sellers and collectors often sort large breach dumps by inferred region, based on domain, language, or IP data, before repackaging them for sale. That sorting makes a list more valuable to buyers who want to target a specific country's institutions, which is likely why this file carries its United States classification.

Check If You Are Affected

HEROIC's free breach scanner searches more than 400 billion records, including region-tagged combolists like this one. Check your email now to see if your Hotmail Combo_2 credentials are exposed.