The Hotmail Fresh by moon_supp1 Leak Exposed 929 Passwords

The Hotmail Fresh by moon_supp1 Leak Exposed 929 Passwords

HEROIC analysts identified a combolist named "hotmail fresh by moon_supp1" that was uploaded to a Telegram channel on 30 April 2025. The file contains 929 records pairing Hotmail email addresses with plaintext passwords and associated URLs, distributed under the handle of a Telegram seller known as moon_supp1.

Why This Is Dangerous

Because the passwords in this file are stored in plaintext, anyone who obtains it can log into the affected Hotmail accounts immediately, without needing to crack or guess a thing. The "fresh" label suggests the credentials were recently obtained, meaning victims may not yet know their accounts have been compromised.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

Even a smaller combolist like this one is enough to power targeted credential stuffing attacks, where an attacker tests each stolen email and password pair against other popular websites. If you reused your Hotmail password anywhere else, this leak could be the first step toward a compromised bank account, hijacked social media profile, or identity theft.

How a Combolist Leak Works

A combolist bundles email or username and password pairs, typically gathered from earlier breaches, phishing pages, or malware infections, into a single file for sale or free distribution. Sellers on Telegram often brand their uploads with a handle, like moon_supp1 here, and market them as "fresh" to signal the credentials are recently obtained and more likely to still work.

Check If You Are Affected

If you use a Hotmail or Outlook account, or if you have ever reused a password on another site, it is worth checking whether your information appears in this leak. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to tell you instantly if your email has been exposed, so you can change any vulnerable passwords right away.