Your Hotmail Account May Be Compromised: 14,041 Passwords Leaked

Fresh Hotmail Combolist: 14,041 Accounts Leaked on Telegram

In January 2025, HEROIC analysts discovered a combolist labeled as a "fresh hotmail hit" circulating in a Telegram channel. The file contained 14,041 records pairing Hotmail email addresses with plaintext passwords and the URLs where each login was captured, a fresh batch of credentials packaged specifically for criminals to test right away.

Why This Is Dangerous

Being labeled "fresh" matters. It signals the credentials have not yet been widely tested, so the accounts are more likely to still be active with the same password. Since the passwords sit in plain, readable text, an attacker does not need to crack anything, they can simply copy the email and password pair and attempt to log straight into the account.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

A Hotmail inbox is often the recovery address for banking apps, social media, and shopping accounts, so a compromised email account can quickly become the key to everything else someone owns online. Attackers use lists like this one for credential stuffing, account takeover, and phishing campaigns sent from the victim's own inbox, and any password reused elsewhere multiplies the damage.

How Combolists Work

A combolist is a simple text file that lines up usernames or email addresses next to their passwords, usually pulled from older leaks, phishing kits, or infostealer malware and then repackaged for quick resale or free sharing. Because the format is so easy to automate against login pages, combolists are prized by criminals precisely because they can be tested against thousands of sites in minutes, which is why this file was already being traded on Telegram shortly after it was compiled.

Check If You Are Affected

If you use or have ever used a Hotmail address, it is worth checking whether your information turned up in this leak. HEROIC's free breach scanner searches more than 400 billion leaked records, including combolists like this one, so you can find out quickly and change any exposed password before someone else uses it.