Hotmail Users Are the Target of the NINHO Private Combolist

In June 2026, HEROIC analysts found a combolist titled "NINHO PRIVATE HOTMAIL" uploaded to a Telegram channel. The file specifically targets Hotmail account holders, containing 2,817 records that pair email addresses with plaintext passwords. Why Hotmail Users Are the Target Here Sellers who curate combolists by email provider, as this one does with Hotmail, are usually optimizing for a specific kind of attacker: someone looking to break into inboxes rather than any random account. An email inbox is often the key to resetting passwords on dozens of other services, which makes a Hotmail-specific list especially valuable to criminals. What Was Exposed in the NINHO Private Hotmail Leak Hotmail email addresses Plaintext passwords Associated website URLs Why This Matters If an attacker gets into your Hotmail inbox, they can often use it to request password resets on your banking, shopping, and social media accounts, effectively using your email as a master key. Anyone in this list of 2,817 accounts is at heightened risk of account takeover that spreads far beyond their inbox, along with financial fraud and identity theft. How Provider-Specific Combolists Get Built Lists labeled "Private" and organized by a single email provider, like this Hotmail-focused file, are usually filtered out of larger combolists or stealer log collections, then repackaged and sold separately because buyers often want credentials tied to a specific platform. This targeted curation is what makes files like NINHO PRIVATE HOTMAIL more valuable to attackers than an unsorted dump. Check If You Are Affected If you use a Hotmail or Outlook account, it is worth checking whether your login appears in this leak. HEROIC's free breach scanner searches more than 400 billion leaked records, including this one, so you can confirm your exposure and secure your inbox before someone else gets in first.