The Hotmail Stealer Log Dropped in June 2025. The Data Is Still Circulating.

HEROIC analysts identified a stealer log targeting Hotmail.com accounts that was uploaded to Telegram in late June 2025. The file, timestamped 29-06-25, exposed 3,247 records containing email addresses, plaintext passwords, and associated URLs. The credentials were harvested from infected machines using infostealer malware and structured into a ready-to-use credential dump targeting Microsoft's email platform specifically. Hotmail-focused credential files like this are highly sought after by attackers because Microsoft accounts often serve as the recovery email or single sign-on for dozens of connected services.

Why This Is Dangerous: What Attackers Gain From Stolen Hotmail Credentials

A compromised Hotmail or Outlook account is more than just email access. Microsoft accounts are linked to OneDrive cloud storage, Xbox gaming profiles, Microsoft 365 documents, Azure subscriptions, and countless third-party services that use "Sign in with Microsoft." Attackers who gain access to a Hotmail account can reset passwords for all connected services, read private emails to find financial information, access stored documents, and lock the legitimate owner out entirely. With 3,247 plaintext credentials available, attackers can begin account takeover attempts immediately without any additional tools or techincal knowledge.

Data Exposed in the Hotmail.com Stealer Log (June 2025)

• Email Addresses (Hotmail.com accounts)
• Plaintext Passwords
• URLs (login endpoints and associated services)

Account Takeover and Downstream Fraud From Hotmail Credential Leaks

Credential stuffing attacks against Hotmail are a well-documented threat vector. Once an attacker gains entry, they typically begin by enumerating connected accounts, resetting passwords for financial services, and sweeping OneDrive for sensitive documents. Identity theft follows when personal files, tax documents, or ID scans are found in cloud storage. Financial fraud escalates when banking notifications or payment confirmations in the inbox allow attackers to intercept transactions. Because many people reuse the same password across platforms, a single Hotmail compromise can cascade into account takeovers across banking, retail, and social media platfroms.

The Hotmail Breach Happened Months Ago. Here Is What That Means for You.

The Hotmail stealer log from June 2025 has had time to circulate through multiple threat actor channels since it was first uploaded. Credentials that start in a private Telegram channel often move to dark web marketplaces, bulk credential databases, and automated stuffing tools within weeks. The longer these credentials remain uncahnged, the more exposure grows. If you use Hotmail or Outlook and have not changed your password recently, your account may already be at risk from this or similar dumps. Acting quickly to change credentials and enable two-factor authentication is the most effective response.

Scan Your Email Now and Stop the Damage Before It Spreads

HEROIC's free breach scanner searches over 400 billion exposed records, including stealer logs targeting Hotmail, Outlook, and other Microsoft account types. Enter your email to find out immediately whether your credentials have been compromised. Scan for free at HEROIC and take action before attackers use your credentials to access your accounts and connected services.