The ‘Hotmail’ Leak Surfaced in May. It’s Still Circulating.

What HEROIC Analysts Found

On May 29, 2026, HEROIC analysts identified a combolist file uploaded to a Telegram channel and labeled "Hotmail," indicating the credentials inside are specifically tied to Hotmail and Outlook email accounts rather than a breach of Microsoft itself. The file contained 504 records pairing email addresses with plaintext passwords and the website URLs those logins were used on. As of this report, the file has already been circulating for months, giving it plenty of time to spread across other Telegram groups.

Why This Is Dangerous

Email inboxes like Hotmail and Outlook are often the master key to a person's other accounts, since password reset links for banking, shopping, and social media typically land in that same inbox. Because the passwords in this file are stored in plaintext, an attacker who gains access to one of these 504 email accounts can potentially reset passwords on every other service tied to it.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated website URLs

Why This Matters

A combolist targeting email accounts specifically is a direct path to credential stuffing and account takeover, since gaining control of someone's inbox often unlocks everything else tied to it. If you are one of the 504 people in this leak, an attacker with access to your Hotmail or Outlook account could reset passwords elsewhere, drain linked financial accounts, or use your identity to commit fraud, all without you noticing until it is too late.

How Combolist Leaks Work

A combolist pairs a username or email with a password, typically written as "email:password" per line, and is usually built from older breaches, malware infections, and previous leaks rather than one single new hack. Files labeled by email provider, like this "Hotmail" combolist, are organized this way because attackers know inbox access is especially valuable, and a leak like this one can keep resurfacing in new Telegram channels long after it first appeared.

Check If You Are Affected

If you use a Hotmail or Outlook account and want to know if your credentials are part of this leak or any other exposure, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. Run a free scan today to see if you were affected and find out what to change immediately.