Inside the Hotmail UHQ Combolist: How 99,779 Passwords Leaked

Inside the "Hotmail UHQ" Combolist: 99,779 Passwords Leaked In July 2026, HEROIC analysts found a combolist labeled "Hotmail UHQ" (a common shorthand for "ultra high quality") uploaded to a Telegram channel. The file contained 99,779 records pairing Hotmail and related Microsoft email addresses with plaintext passwords, a large enough batch to make it valuable to anyone running automated login attacks. Why a "High Quality" Label Makes This Leak More Dangerous Sellers mark combolists as "UHQ" when the credentials have been checked and are believed to still be active and working, unlike older dumps full of dead logins. That means the 99,779 email and password pairs here are more likely to succeed if an attacker tries them, making this file especially valuable to criminals and especially risky for the people on it. What Was Exposed Email addresses Plaintext passwords Associated URLs Why This Matters A batch this size, verified as high quality, is built for large-scale credential stuffing. Automated tools can run through all 99,779 email and password pairs in a short time, testing each against banking sites, email providers, and social platforms. Anyone who reused their Hotmail password elsewhere faces a real risk of account takeover, financial fraud, or identity theft. How a Combolist Leak Works A combolist compiles email or username and password pairs from breaches, phishing pages, and malware infections, then sorts and verifies them before resale. "UHQ" batches like this one typically go through a checking process that removes dead accounts, leaving a leaner, more dangerous file that attackers value more highly than an unverified dump of the same size. Check If Your Hotmail Account Is in This Leak With 99,779 verified logins already circulating from this file, it's worth checking whether your email is among them. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, so you can find out instantly and change your password before someone else logs in first.