The Hotmail Hits 2 Password Leak Has Been Circulating Since 2024

HEROIC analysts identified a small combolist called Hotmail Hits 2 that a Telegram user uploaded in October 2024. The file contains 787 records pairing email addresses with plaintext passwords, along with the URLs where each credential was used. This is a modest dump compared to many combolists on the market, but every record in it is still a live, working set of credentials as far as we can confirm. Why This Is Dangerous: The passwords in this file are stored in plaintext, so anyone who gets a copy can log in with them immediately, no cracking needed. A small file size does not mean small risk. A criminal only needs one working login to cause damage to that individual account holder. What Was Exposed: - Email addresses - Plaintext passwords - URLs tied to each account Why This Matters: If your email and password show up in a list like this, and you have reused that password elsewhere, an attacker can use it to log into your other accounts. That is how credential stuffing works, and it can lead to account takeover, identity theft, and financial fraud, especially since this specific list has already been circulating for close to two years. How a Small Combolist Like This Gets Made: Not every combolist comes from a single major hack. Many, like this one, are smaller batches that criminals piece together from phishing pages, malware infections, or older leaked data, then label with a theme, in this case Hotmail-related accounts, before sharing them in Telegram channels. Small combolists like this often fly under the radar longer because they attract less attention than headline breaches. Check If You Are Affected: HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including small combolists like this one. Run a scan to see if your credentials are part of this exposure and get clear steps to secure your accounts.