Hotmail Combolist Leak Targets 1,151 Outlook Email Accounts

Hotmail Combolist: 1,151 Accounts Exposed

In May 2026, HEROIC analysts identified a combolist labeled "1.1K Hotmail," uploaded to a Telegram channel by an anonymous user. The file contained 1,151 records pairing email addresses, mostly Hotmail and Outlook accounts, with plaintext passwords and the URLs those credentials were tied to. The list appears to have been deliberately curated to focus on Hotmail users specifically, rather than pulled from a broad, mixed source.

Who Is Targeted

This leak singles out Hotmail and Outlook account holders. Because Microsoft accounts often serve as the recovery email or login method for other services, banking portals, shopping accounts, cloud storage, and social media, a compromised Hotmail login can become a gateway into someone's entire digital life. Attackers know this, which is likely why this list was compiled around a single email provider instead of scattered domains.

What Was Exposed

• Email addresses (primarily Hotmail/Outlook)
• Plaintext passwords
• URLs of the associated accounts

Why This Matters

Plaintext passwords require no cracking, so anyone who downloads this file can attempt to log in immediately. If a victim reused their Hotmail password anywhere else, that same password becomes a skeleton key for other accounts too. This is how credential stuffing works: attackers take confirmed email and password pairs and test them across many other sites, hoping the person reused the login. The result can be account takeover, unauthorized purchases, or full identity theft if enough personal information is accessible once inside.

How a Combolist Attack Works

A combolist is a curated file of email or username and password combinations, often built by filtering larger stolen datasets down to a specific target, in this case, Hotmail users. Because the list was narrowed to one provider, attackers running it through automated login tools can move faster and more precisely than with an unsorted dump. The absence of encryption on these passwords means the file is immediately usable the moment it is downloaded.

Check If You Are Affected

If you have a Hotmail or Outlook account, it is worth confirming whether it appears in this leak. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records and will let you know right away if you were exposed. If you find a match, change your password immediately and enable two-factor authentication on your Microsoft account for extra protection.