HOTMAIL COMBO MAIL ACCESS Leak Hits Webmail Users: 2,201 Records

HEROIC analysts identified a stealer log dump labeled "HOTMAIL COMBO MAIL ACCESS," uploaded to a Telegram channel on 07-Jun-2026. The file contained 2,201 records, including email addresses, plaintext passwords, and the URLs of the mail services those logins unlock.

Why Webmail Access Makes This Leak Especially Risky

This dump is built specifically around email account access rather than a single retail or social platform, which puts it squarely in the webmail and communications space. An email inbox is the master key to most of a person's digital life, used to receive password reset links, two-factor codes, and account notifications, so gaining entry to it hands an attacker far more than just an inbox to read.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the mail services tied to each login

Why This Matters

Because these passwords are unencrypted and matched to the exact mail service they unlock, attackers can achieve immediate account takeover of the inbox itself. From there, they can request password resets on banking, shopping, or social accounts linked to that email, and if the same password was reused, credential stuffing can extend the damage even further.

How Stealer Logs Work

Stealer log malware infects a device, often through a fake download or malicious attachment, and quietly records saved passwords, autofill data, and browser session details as they are typed. The results are packaged into a log file, sometimes marketed as "mail access" or a "combo list," and sold or shared on Telegram channels and dark web forums.

Check If You Are Affected

If you use a Hotmail or Outlook address, use HEROIC's free breach scanner to check whether your credentials appear in this or any other leak. It searches a database of more than 400 billion breached and leaked records to show you instantly if your information has been exposed.