HOTMAILS: 784 Stolen Email and Password Pairs Hit the Dark Web

HEROIC analysts identified a combolist named "HOTMAILS" that traces back to November 29, 2024, and was uploaded to a Telegram channel. The file contains 784 records of email addresses, plaintext passwords, and the URLs each login was used on, focused specifically on Hotmail and related Microsoft accounts. Why this is dangerous: a Hotmail or Outlook inbox is often the account that controls password resets for everything else, banking, shopping, social media, and more. With 784 plaintext email and password pairs in this file, an attacker can log directly into each affected inbox and use it to seize control of other linked accounts. What was exposed in the "HOTMAILS" combolist: Hotmail and Microsoft email addresses, plaintext passwords, and the URLs of the accounts each login was used on. Why this matters: even a smaller list like this one carries outsized risk because it targets email accounts directly. Anyone whose Hotmail credentials appear here is exposed to account takeover, and from there, an attacker can reset passwords on any other account tied to that inbox, opening the door to identity theft and financial fraud. How a combolist like this one comes together: combolists like "HOTMAILS" are typically assembled from older breaches, phishing pages, and malware-infected devices, then filtered down to a single provider so buyers can target Hotmail or Outlook accounts specifically. Lists filtered by email provider are common on Telegram because they let criminals focus their efforts on one type of account instead of sorting through unrelated data. Check if you are affected: if you use a Hotmail or Outlook email address, it's worth checking whether your credentials appear in this leak. HEROIC's free breach scanner searches more than 400 billion leaked records to show your exposure and help you secure your account.