HEROIC Analysts Found the Hotmail3 Dump Circulating on Telegram

In April 2024, HEROIC analysts found a stealer log labeled "Hotmail3," attributed to a Telegram user going by the handle "ryder699," circulating with 1,231 exposed records made up of email addresses, plaintext passwords, and the site URLs each login belongs to.

Why a Named, Attributed Dump Is Still a Threat

Unlike anonymous leaks, this file carries a handle, "ryder699," suggesting it comes from someone actively distributing stolen logins under a recognizable name in Telegram trading circles. That kind of attribution often means the data has already been shared, resold, or checked for validity by others before HEROIC analysts found it, increasing the odds that the accounts inside are still active and unprotected.

What Was Exposed

• Email addresses, with a concentration of Hotmail and Outlook accounts
• Plaintext passwords, readable without any need to crack or decrypt them
• URLs identifying the exact site or service tied to each stolen login

Why This Matters

Email accounts, especially Hotmail and Outlook logins, are often the master key to a person's digital life, used to reset passwords for banking, shopping, and social media accounts. If an attacker gets into the email address in this log, they can often chain that access into other accounts through password reset links, turning one stolen login into many.

How a Log Like Hotmail3 Gets Assembled

Stealer logs are built by malware that infects a victim's computer, typically through cracked software, fake game cheats, or malicious email attachments, then silently records every login typed into a browser. Distributors like "ryder699" collect these logs, sometimes merging multiple infections into one file, then name and upload them to Telegram channels for sale or trade. Naming a file after the email provider it targets, such as Hotmail, helps buyers quickly find the accounts they want.

Check If You Are Affected

If you use a Hotmail or Outlook account, it is worth checking whether your login appears in this or a similar log. HEROIC's free breach scanner searches your email address against a database of more than 400 billion breached and leaked records, so you can see your exposure immediately and secure your account.