Someone Has Your Hotmail Password: 72 Credentials Leaked

HEROIC analysts have detected a stealer log specifically targeting Hotmail users, uploaded to Telegram on April 21, 2026, under the label Hotmail TXTVALID. The file contains 72 records, each including a Hotmail email address, a plaintext password, and the URL where the credentials were captured. The "TXTVALID" label indicates these credentials were likely verified as working before being distributed, making this a curated list of confirmed, exploitable Hotmail logins.

Why Your Hotmail Password in Plaintext Is an Emergency

A compromised email account is not just one lost login — it is the gateway to your entire digital identity. Hotmail and Outlook accounts serve as recovery addresses for banking, social media, shopping, and cloud storage platforms. An attacker with access to your email inbox can reset passwords on virtually every other service you use.

Because these passwords are in plaintext and pre-validated, there is no delay between an attacker obtaining this file and accessing your inbox. They can read private conversations, intercept two-factor authentication codes sent via email, and impersonate you to your contacts. The urgency cannot be overstated.

What Was Exposed in the Hotmail TXTVALID Dump

• Email Addresses — Hotmail and Outlook email accounts that serve as both primary login identifiers and recovery addresses for countless other services.
• Plaintext Passwords — Validated, unencrypted passwords confirmed to grant access to the associated email accounts at the time of distribution.
• URLs — The web addresses where these credentials were originally captured by the malware, mapping out additional services the victim uses.

Why Email Account Compromise Triggers a Chain Reaction

When an attacker controls your email, they control the password reset process for nearly every online account linked to it. Banking platforms, e-commerce sites, cloud storage services, and corporate tools all rely on email-based password recovery. A single compromised Hotmail account can lead to a cascade of account takeovers across a victim's entire digital footprint.

Beyond password resets, attackers can use a compromised email to launch phishing attacks against the victim's contacts, intercept sensitive communications, and access documents shared through Microsoft services like OneDrive. The 72 individuals in this dump each face the risk of total account compromise stemming from a single leaked credential.

How Stealer Logs Single Out Email Providers

The fact that this file is filtered specifically for Hotmail credentials reveals a deliberate targeting strategy. After infostealer malware harvests credentials from an infected device, operators often sort the data by email provider. Hotmail and Outlook accounts are particularly prized because of their integration with the Microsoft ecosystem, including Office 365, OneDrive, Skype, and Xbox Live.

The sorting and validation process produces files like Hotmail TXTVALID — small, focused datasets of confirmed working logins that command higher value in cybercrime markets. Attackers who purchase or download these curated files know exactly what they are getting: verified access to active Microsoft email accounts.

Check If Your Credentials Appear in This Leak

If you have ever used a Hotmail or Outlook email address, checking your exposure is critical. HEROIC's free breach scanner searches more than 400 billion compromised records to determine whether your email and password have appeared in this dump or any other known data leak.

If your Hotmail credentials are found, change your Microsoft account password immediately and enable two-factor authentication using an authenticator app rather than SMS or email. Review your account's recent sign-in activity for unauthorized access, and check whether any password reset emails were sent to accounts you do not recognize. Securing your email account is the single most impactful step you can take to protect your broader online presence.