The Hotmail Combolist Contains Exactly 411 Plaintext Password Pairs

In November 2025, HEROIC analysts identified a combolist labeled "Hotmail" circulating on Telegram that exposed exactly 411 records containing email addresses, plaintext passwords, and the URLs tied to each account. As with other small Telegram uploads, this file was shared directly by an individual user rather than tied to a single corporate breach.

Why This Is Dangerous

Every password in this file is stored in plaintext, so there is no hashing or encryption standing between an attacker and a working login. Paired with the URL for each account, the 411 records in this file give an attacker a ready-to-use list of Hotmail logins that can be tested immediately, with no extra work required to crack anything.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to each account

Why This Matters

A file of 411 records is small compared to breaches involving millions of accounts, but the danger to each person on the list is the same. If any of these Hotmail email and password combinations are reused elsewhere, they can be used for credential stuffing, account takeover, and identity theft. Email accounts are especially valuable to attackers because they are typically used to reset passwords across banking, shopping, and social media accounts.

How This Combolist Was Built

A combolist like this one is assembled by pulling matching email and password pairs from smaller sources, such as phishing kits, malware infections, or older leaks, then combining them into a single file focused on one email provider, in this case Hotmail. Telegram makes it simple to upload and circulate files like this quickly, which is why small, targeted combolists continue to surface alongside larger breach dumps.

Check If You Are Affected

If you use a Hotmail or Outlook account with a password you have reused on other sites, it is worth checking now. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to show whether your email and credentials appear in this leak or any other, so you can update your passwords before someone else does.