Hotmail Combo 3 Leak: 1,487 Logins, More Than a Full Auditorium

In June 2026, HEROIC analysts identified a file circulating on Telegram called "Hotmail Combo 3," containing 1,487 records of Hotmail account credentials. That is more accounts than fit in a full school auditorium, all in a single file passed around a Telegram channel. The data included email addresses, plaintext passwords, and the URLs of the login pages each credential was used on.

Why This Is Dangerous

A "combo" file like this pairs a working email address directly with its plaintext password and the exact site it unlocks, removing every extra step an attacker would otherwise need to take. There is no need to crack an encrypted hash or guess which website a stolen password belongs to, the login URL is right there in the same record. For 1,487 people, that means their Hotmail credentials are sitting in a ready-to-use format anyone downloading the file can act on immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

A Hotmail or Outlook account is often the central hub tied to banking alerts, shopping accounts, and password reset emails for dozens of other services. If any of these 1,487 credentials still work, an attacker can gain access to that inbox and use it to reset passwords elsewhere, a form of account takeover that can quickly spiral into identity theft or financial fraud. Password reuse makes the danger worse, since the same email and password combination can often unlock accounts on completely unrelated platforms through credential stuffing.

How Stealer Logs and Combo Lists Work

Files like "Hotmail Combo 3" typically start as stealer logs, the output of malware that infects a device and quietly harvests saved browser passwords, autofill entries, and login sessions. Criminals then sort and organize that raw data into combo lists grouped by email provider, as this one appears to be, making it easier for buyers to target a specific type of account. These curated files are traded and sold across Telegram channels and dark web marketplaces, often for a fraction of what the stolen access is actually worth to the person who ends up using it.

Check If You Are Affected

If you have a Hotmail or Outlook account, it is worth finding out whether your credentials appear in this leak or any other. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including combo lists and stealer logs like this one, so you can see your exposure and update any at-risk passwords before someone else uses them.