One Telegram Upload. 398 Hotmail Logins. The Fresh B4_Jx Leak.

HEROIC analysts reviewed this combolist after a Telegram user uploaded it in late May 2026 under the label Hotmail Fresh B4_Jx. One file. One upload. 398 records of email addresses, plaintext passwords, and the URLs those logins were used on, focused specifically on Hotmail accounts. It is a small file, but every one of those 398 records is a working login someone can use right now. Why This Leak Is Dangerous: Because the passwords are stored in plain, readable text, anyone who downloads the file can log straight into an affected Hotmail inbox with no cracking involved. The fresh label suggests the uploader is presenting these as recently obtained credentials, which matters because newer logins are less likely to have already been changed by the account owner. What Was Exposed: - Hotmail email addresses - Plaintext passwords - URLs tied to each set of credentials Why This Matters: A Hotmail inbox is often used to reset passwords for banking, shopping, and other online accounts. If an attacker gets into one of these 398 inboxes, they can potentially take over several other accounts tied to that email address, and if the password was reused elsewhere, credential stuffing attacks can widen the damage even further. How Small Fresh Combolists Like This Get Made: A combolist is a plain text file pairing emails or usernames with passwords, usually pulled from phishing pages, malware-infected devices, or earlier breaches and repackaged as a labeled batch. Small, targeted files like this one focused on a single email provider are common on Telegram, where uploaders often specialize in one type of account to attract buyers looking for something specific. Check If You Are Affected: HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including small combolists like this 398-record file. Run a free scan to see if your Hotmail address or any other account shows up in HEROIC's database.