Hotmail28 Leak: 2,611 Email and Password Pairs Found on Telegram

HEROIC analysts identified a combolist named Hotmail28 uploaded to a Telegram channel on March 27, 2026. The file contains 2,611 records pairing email addresses with plaintext passwords and the login URLs they belong to. Why This Is Dangerous: Every password in this file is stored in plain, readable text, so no cracking or decryption is needed. Anyone who downloads the list can immediately try each email and password pair on other websites, and the attached URLs tell them exactly which service to target first. What Was Exposed: - Email addresses - Plaintext passwords - Login URLs tied to each account Why This Matters: People commonly reuse the same password across multiple accounts. If your email and password appear in this list, attackers can use automated tools to test that same combination against banking sites, social media, and shopping accounts, a technique known as credential stuffing. That can lead to account takeover, identity theft, or unauthorized purchases. How a Combolist Like This Works: A combolist is a plain text file that pairs usernames or emails with passwords, usually pulled together from older breaches, phishing pages, or malware-infected computers. Telegram channels are a common distribution point because they let anyone upload and share these files quickly and anonymously, often for free or in exchange for a small fee. Once uploaded, the file can be downloaded by anyone and fed into automated login tools within minutes. Check If You Are Affected: You can check whether your email address appears in this leak or any of the other breaches HEROIC has indexed. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, so you can find out in seconds and take action, like changing reused passwords, before someone else does.