How the Hotmail Full Hits List Led to 1,500 Stolen Logins

What HEROIC Analysts Found

In December 2024, HEROIC analysts identified a combolist file labeled "Hotmail 1.5K Full Hits 01.12," uploaded to a Telegram channel. The file contained 1,500 records pairing Hotmail and Outlook email addresses with plaintext passwords and the URLs of the login pages they belong to.

Why This Is Dangerous

The term "full hits" means every login in this file was tested and confirmed to work before it was shared, not just scraped and hoped for. That makes it more dangerous than a random, unverified list: whoever gets this file knows the credentials are current and functional against real Hotmail and Outlook accounts.

What Was Exposed

• Email addresses (Hotmail and Outlook accounts)
• Plaintext passwords
• URLs linking each login to the site it belongs to

Why This Matters

A verified Hotmail or Outlook login often unlocks more than just email. It can be used to receive password reset codes for banking, shopping, and social media accounts, letting an attacker pivot from one inbox into several other accounts. Because this list was labeled as "full hits," meaning every entry was checked, the risk of active account takeover is higher than with an older, unconfirmed leak.

How Combolists Work

A combolist is a compiled file of email or username and password pairs, usually pulled from earlier breaches, stealer logs, or leaked databases. To create a "full hits" list like this one, sellers run raw credential lists through automated checker tools that attempt to log into each account, keeping only the entries that succeed before packaging and sharing the confirmed results.

Check If You Are Affected

If you use a Hotmail or Outlook email address, it is worth finding out whether your login shows up in this leak or any other. HEROIC's free breach scanner checks it against a database of more than 400 billion leaked records, so you can act quickly if needed.