2,001 Passwords From the HOTMAIL Fresh Dump Just Surfaced Online

HEROIC analysts have flagged a combolist file called “HOTMAIL Fresh uploaded by a Telegram User,” which surfaced on Telegram on March 30, 2024. The file contains 2,001 records tied primarily to accounts in the United States, pairing email addresses and usernames with plaintext passwords and the URLs those credentials unlock. The name of the file suggests the credentials are specifically tied to Hotmail and Outlook style email accounts.

Why This Is Dangerous

Each of the 2,001 records in this file links a real email address to its matching plaintext password and the exact site it logs into. Because email accounts are often used to reset passwords for other services, gaining access to one is often the first step in a much larger attack. The passwords here are stored without any encryption, so anyone who downloads the file can attempt to log in immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to each set of credentials

Why This Matters

If any of these 2,001 accounts reused their password on other services, attackers can attempt credential stuffing to break into banking, shopping, or social media accounts. Because email accounts are frequently used to verify identity and reset other passwords, a compromised email login can quickly cascade into wider identity theft and financial fraud.

How Combolists Work

A combolist is a compiled file of email or username and password pairs, typically gathered from earlier breaches and stealer logs and organized into one list. Criminals trade combolists like this one because the format makes it simple to test each pair against login pages using automated tools. The HOTMAIL Fresh file follows this pattern, bundling 2,001 credential pairs together with the URLs needed to use them right away.

Check If You Are Affected

To find out if your email address is part of this leak or any other breach, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. Run a scan now and update any passwords you have reused across multiple accounts.