One Telegram Upload. 344 Hotmail Logins Exposed in Plaintext.

HEROIC analysts examined a small combolist labeled "Hotmail Fresh B4_Jx" that a Telegram user uploaded on May 17, 2026. The file is tiny compared to major leaks, just 344 records, but each one pairs a Hotmail email address with a plaintext password and the URL the credentials unlock. Why this is dangerous: small size does not mean small risk. Every one of the 344 records in this file is a working login sitting in plaintext, meaning an attacker can open the file and start testing credentials immediately, without decoding or cracking anything. A smaller file is also easier for a single attacker to work through by hand, checking each entry individually. What was exposed: the dataset lists Hotmail email addresses, plaintext passwords with no encryption protecting them, and the specific URLs tied to each account, giving anyone who obtains the file complete login information for all 344 records. Why this matters: Hotmail and Outlook accounts are often used as the recovery email for other services, meaning a compromised login can be used to reset passwords on banking, shopping, and social media accounts tied to that address. Attackers use even small combolists like this for credential stuffing, testing each pair against other popular sites, and password reuse means a single exposed Hotmail login can unravel a person's entire online identity. How this combolist was likely built: "fresh" combolists like this one are typically compiled from recent stealer malware infections or phishing pages, then filtered down to a specific email provider, in this case Hotmail, and labeled "fresh" to indicate the credentials have not yet been widely circulated. Even a batch this small can be valuable to a buyer who wants a short, unspoiled list of working logins rather than sifting through a massive, already-picked-over file. Check if you are affected: if you have a Hotmail or Outlook email address, it is worth checking whether your credentials appear in this leak or any other, regardless of how small the batch may seem. HEROIC's free breach scanner searches more than 400 billion leaked records, giving you an instant answer so you can change any exposed passwords before someone else uses them.