If You Use Hotmail and Facebook, This 351 Record Leak Matters

In late March 2025, HEROIC analysts identified a small stealer log posted to Telegram titled 1700x Hotmail Country Sorted FB capybarabases, containing 351 exposed records. Each entry pairs a Hotmail email address with a plaintext password and the URL of the login page it opens, along with an apparent link to Facebook account access, consistent with malware that harvests saved credentials from an infected browser.

If You Use Hotmail and Facebook, This Small Leak Matters

Even though this file is small compared to some of the stealer logs HEROIC tracks, the combination of Hotmail credentials sorted by country alongside Facebook account references makes it especially useful to attackers targeting specific regions. If your Hotmail and Facebook accounts share a password, being one of these 351 records means both could be at risk from a single leaked credential.

What Was Exposed in the Capybarabases File

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

Facebook accounts often store personal photos, messages, and connections to other linked services, while Hotmail inboxes are commonly used to reset passwords elsewhere. Together, this combination increases the risk of account takeover and identity theft for anyone in this file who reused a password across these platforms.

How a Country-Sorted Stealer Log Like This Gets Made

Infostealer malware infects a device through cracked software or malicious downloads, then automatically pulls every saved password and login URL from the browser, including social media sessions. Sellers then sort the raw output by country and by platform, in this case Hotmail and Facebook, to create a more targeted product that buyers can filter by region before purchasing on Telegram.

Check If You Are Affected

If you use Hotmail or Facebook, it takes only a moment to check whether your login appears in this leak. HEROIC's free breach scanner searches a database of more than 400 billion compromised records so you can confirm your exposure and secure your accounts.