Hotmail Combolist Explained: 201 Accounts Leaked Online

201 Hotmail Accounts Leaked in a Telegram Combolist

HEROIC analysts identified a small but concerning combolist uploaded to Telegram on 19 December 2022. The file contained 201 records of Hotmail account credentials, pairing email addresses with plaintext passwords, along with associated URLs showing where the logins were used.

Why This Is Dangerous

Because the passwords in this list are stored in plaintext, an attacker can use them immediately, with no cracking required. A compromised Hotmail inbox is often the master key to a person's entire digital life: it can be used to trigger password resets on banking apps, shopping accounts, and social media, letting an attacker cascade into far more damaging access than the inbox alone.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

A 201-record list is tiny compared to billion-record mega breaches, but small lists get less attention from security teams and are just as usable for credential stuffing. If any of these 201 people reused their Hotmail password on another site, attackers can walk straight into account takeover, financial fraud, or identity theft using nothing more than this leaked file.

How Combolists Work

A combolist is a compiled file of email-or-username-and-password pairs, typically pulled together from older breaches, phishing kits, or malware logs and repackaged for free or paid distribution. Criminals load these lists into automated tools that test every pair against dozens of websites at once, relying on the simple fact that many people reuse passwords across accounts. Telegram has become a favored home for these files because uploads are instant and largely unmoderated.

Check If You Are Affected

If you have ever used a Hotmail or Outlook address with a password you have reused elsewhere, it is worth checking your exposure now. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including this combolist, so you can find out in seconds and secure your accounts before someone else uses this data first.