The et0kenneth Leak Exposed 128 US Hotmail Accounts With Validated Passwords

HEROIC analysts confirmed that the Hotmail Valid et0kenneth stealer log, uploaded to Telegram on February 14, 2025, exposed 128 verified Hotmail account credentials with a primary focus on US-based Microsoft account users. This second et0kenneth batch -- smaller but more precisely targeted than the February 12 release -- contains email addresses, plaintext passwords, and URLs that were confirmed active at the time of collection. The "Valid" label means each credential in this set was tested against live Microsoft login endpoints before distribution to buyers.

Why US-Based Hotmail Users Face Elevated Risk From This Breach

United States Hotmail account holders are high-value targets for credential theft operations because US email addresses are frequently linked to financial accounts, healthcare portals, tax filing services, and government platforms that attackers can monetize quickly. Validated US credentials command premium prices on dark web markets, and the tight targeting in this dataset suggests the et0kenneth operator deliberately curated US-linked accounts for this release to maximize buyer demand.

Data Exposed in the Hotmail Valid et0kenneth February 14 Stealer Log

The following data types were confirmed in this 128-record verified Hotmail credential dump:

• Email Addresses (US-linked Hotmail and Outlook accounts)
• Plaintext Passwords (verified working at time of capture)
• URLs (Microsoft login portals and associated service endpoints)

How Validated US Hotmail Credentials Enable Account Takeover and Identity Theft

Verified credentials for US Hotmail users open a particularly damaging range of attack paths:

• IRS and tax platform access: US email accounts are frequently linked to tax filing services; a compromised inbox gives attackers access to refund diversion and identity fraud
• Account takeover: Validated credentials mean immediate, uncontested login -- no guessing or brute-forcing required before the damage begins
• Healthcare portal intrusion: US Microsoft accounts are often linked to patient portals, insurance platforms, and pharmacy login systems
• Financial fraud: Bank accounts, investment platforms, and payment servises that use Hotmail for two-factor verification are exposed the moment the inbox is compromized
• Identity theft: Full legal names, addresses, and linked phone numbers stored in Microsoft accounts support fraudulent credit applications and synthetic identity schemes

How the et0kenneth Operator Builds and Distributes Verified Credential Sets

The et0kenneth series follows a consistent pattern: raw infostealer log output is filtered for Hotmail and Microsoft account credentials, then each candidate is run through an automated checker that confirms the username and password still grant active login access. Only the verified results are packaged and sold. This workflow is entirely automated and can processe thousands of raw credentials per hour, meaning that even a small 128-record validated set represents the highest-confidence subset of a much larger underlying theft operation. Buyers receive assurance that each credential in the set was working on the day it was packaged.

Check If Your Hotmail Account Was Included in This Validated US Credential Dump

If you hold a US-based Hotmail or Outlook account, your credentials may appear in this validated et0kenneth dataset or a related batch. HEROIC's free breach scanner searches more than 400 billion compromised records to give you an immediate answer. Given that every credential in this dataset was confirmed active before distribution, the window between exposure and account takeover is shorter than in any other breach type. Run your free scan now and find out whether your Microsoft account is already in the hands of a criminal buyer.