Webmail Users Targeted: Hotmail Combolist Leaks 347 Passwords

HEROIC analysts spotted this combolist in early June 2026 after a Telegram user uploaded it to a public channel. The file is small by breach standards, containing 347 records of email addresses, plaintext passwords, and the URLs those credentials were used on, with a focus on Hotmail accounts. This is not a breach of Hotmail or Microsoft itself. It is a compiled list of previously stolen Hotmail credentials repackaged for distribution. Why This Combolist Is Dangerous: Every password in this file is stored in plain, readable text, meaning anyone who downloads it can log straight into an affected inbox without cracking or guessing anything. A compromised Hotmail account often doubles as a recovery email for banking, shopping, and social media logins, so gaining access to one inbox can hand an attacker the keys to several other accounts. What Was Exposed: - Email addresses - Plaintext passwords - URLs tied to each set of credentials Why This Matters: A working email and password pair is one of the most valuable things an attacker can have. Beyond reading someone's inbox, they can trigger password resets on other services, impersonate the account owner, and pull off credential stuffing attacks against sites where the same password was reused. Even a small list like this one can lead to real account takeover and financial fraud for the people affected. How Combolist Leaks Like This Happen: A combolist is a plain text file that pairs emails or usernames with passwords, usually assembled from older breaches, phishing campaigns, or malware infections and then shared or sold on Telegram. Small combolists like this 347-record file are common on Telegram channels, where low-effort uploads circulate constantly, often overlapping with larger, previously known breaches. Check If You Are Affected: HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including small combolists like this one that rarely make headlines. Run a free scan to see if your Hotmail address or any other account shows up in HEROIC's database.