The Hotmail Combolist Quietly Surfaced With 1,528 Stolen Passwords

What HEROIC Analysts Found in the Hotmail Combolist

On February 13, 2026, HEROIC analysts identified a combolist tied to Hotmail accounts that had quietly surfaced after being uploaded to a Telegram channel by an individual user. The file contains 1,528 records pairing email addresses with plaintext passwords, along with the URLs of the login pages those credentials unlock. The accounts affected are tied primarily to the United States.

Why This Is Dangerous

Hotmail and other webmail accounts are often the master key to a person's digital life. Password reset links, financial statements, and account recovery notices for banking, shopping, and social media all pass through email. Because the passwords in this file are stored in plaintext, anyone who obtains the list can read and use them immediately, no cracking required, giving an attacker a direct path into the inbox and everything connected to it.

What Was Exposed in the Hotmail Combolist

• Email addresses
• Plaintext passwords
• URLs identifying the associated login pages

Why This Matters for Hotmail Users

A leaked email and password pair is often the starting point for a much bigger compromise. Attackers use working webmail logins to trigger password resets on other accounts, intercept two factor authentication codes sent by email, and impersonate the account owner in scams targeting contacts. If any of the 1,528 people in this file reused their Hotmail password on another site, that exposure spreads to every account sharing the same credentials.

How This Combolist Was Likely Built

Combolists like this one are usually assembled by collecting email and password pairs from older breaches, phishing pages, or malware infected devices, then filtering them down to a specific email provider such as Hotmail. The resulting file is passed around or sold in Telegram channels, where low effort attackers can use it immediately without any technical skill.

Check If You Are Affected

If you use a Hotmail account, or any email address, it is worth checking whether your credentials appear in this leak or others like it. HEROIC's free breach scanner searches a database of more than 400 billion leaked records so you can see your exposure and update any reused passwords before someone else uses them first.