Hotmail Users Targeted in New ‘hotmail_hits’ Password Leak

138 Hotmail Accounts Exposed in the "hotmail_hits" Combolist

On July 7, 2026, HEROIC analysts found a combolist labeled "hotmail_hits" circulating in a private Telegram channel, specifically targeting Hotmail and Outlook users. The file contained 138 records pairing email addresses with plaintext passwords, along with URLs identifying the sites each credential was captured from.

Why This Combolist Is Dangerous

Because this list is filtered down to a single email provider, an attacker gets a focused set of accounts to target rather than a random mix. With plaintext passwords included, there is nothing standing between the file and a working login. An attacker can try each pair immediately against Hotmail, Outlook, and any other site tied to the leaked URLs.

What Was Exposed in the "hotmail_hits" Leak

• Hotmail and Outlook email addresses
• Plaintext passwords
• URLs tied to each credential pair

Why This Matters for Hotmail and Outlook Users

Email accounts are often the key to everything else, since most services use email to verify identity and reset passwords. If your Hotmail or Outlook account is in this leak, and especially if you have reused the password elsewhere, an attacker could use it to reset passwords on your other accounts, access personal messages, or attempt financial fraud through linked services.

How Provider-Specific Combolists Are Built

Attackers often sort large stolen credential collections by email domain, splitting out Hotmail, Gmail, Yahoo, and other providers into separate files that are easier to sell and target. These filtered lists circulate in private Telegram channels, where buyers use automated tools to test each login against the matching email provider and any other site in the file.

Check If You Are Affected

If you use a Hotmail or Outlook address, HEROIC's free breach scanner checks your email against a database of more than 400 billion exposed records. Run a scan now to see if your credentials appear in this leak or any other breach, and update your password if they do.