Researchers Link ryder699’s ‘Hotmail3’ Leak to 1,348 Logins

HEROIC analysts traced a combolist called "Hotmail3," posted to Telegram by a user going by ryder699 on 07-Apr-2024. The file contains 1,348 records, each pairing a Hotmail email address with a plaintext password, plus URLs tying the credentials back to the accounts they came from.

Why This Is Dangerous

This list targets Hotmail accounts specifically, meaning the person who compiled it has already screened for a single email provider rather than sharing a random mix of credentials. Since Hotmail and Outlook inboxes are commonly used as the recovery email for banking, shopping, and social accounts, an attacker who gets into one of these mailboxes can often use it as a launchpad into other accounts tied to it.

What Was Exposed

• Hotmail email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

Even at 1,348 records, a focused list like this carries outsized risk because email accounts sit at the center of so many password reset flows. If someone in this file reused their Hotmail password elsewhere, attackers can use credential stuffing to break into those other accounts too, and once inside a mailbox, they can reset passwords on connected services to escalate into account takeover, financial fraud, or identity theft.

How This Combolist Was Built

Lists labeled with a provider name like "Hotmail3" are usually produced by running previously leaked or guessed credentials through automated checker software configured to test logins against that specific email service, keeping only the ones that work. The "3" in the name suggests this is one release in a series, with the uploader, ryder699, likely having shared earlier batches under the same naming pattern.

Check If You Are Affected

If you use a Hotmail or Outlook address, it is worth checking whether it appears in this leak or in any other breach HEROIC tracks. HEROIC's free breach scanner searches a database of more than 400 billion exposed records in seconds. If your email is a match, change your password right away and update it anywhere else you have reused it.