Hotmail Credential Leak: 389,596 Plaintext Passwords Exposed

On 08-Jan-2023, a Telegram user uploaded a stealer log file labeled "HOTMAIL NEW 0824," exposing 389,596 records of stolen login data. The file contained email addresses, plaintext passwords, and the URLs of the websites those credentials were used on, all harvested directly from infected devices rather than stolen from a single company's servers.

Why This Is Dangerous

This is not a typical corporate data breach. It's a stealer log, a raw dump of credentials pulled straight from malware-infected computers. That distinction matters because the passwords inside were captured in plaintext, exactly as the victims typed them. There's no encryption to break and no hash to crack. Anyone who downloads this file can try the logins immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the websites the credentials were used on

Why This Matters

Nearly 390,000 working username-and-password pairs are now circulating on Telegram. Because most people reuse passwords across multiple sites, attackers routinely take logins from one leak like this and try them against email, banking, and social media accounts elsewhere, a tactic known as credential stuffing. When it works, it leads to account takeover, identity theft, and financial fraud, often before the victim even realizes their credentials were exposed.

How Stealer Logs Work

Stealer malware typically arrives disguised as cracked software, a fake browser update, or a malicious email attachment. Once it's running on a device, it quietly scans the browser for saved passwords, autofill entries, and the web addresses tied to them, then packages everything into a single file and sends it back to whoever controls the malware. That file, or "log," gets bundled with thousands of others and sold or given away in Telegram channels like the one behind this 389,596-record leak. The victim's device is compromised the entire time the malware runs, meaning newly typed passwords can end up in the next log too.

Check If You Are Affected

With a leak this size, the safest move is to check your own exposure directly. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including stealer logs like this one, and tells you instantly if your email address has turned up in a breach. If you find a match, change the password on the affected account right away, avoid reusing it anywhere else, and turn on multi-factor authentication wherever it's offered.