Just 168 Lines, Real Passwords: Inside the Hotmails Combolist Leak

HEROIC analysts identified a combolist simply named "hotmails," uploaded by a Telegram user on 3 July 2025. It's a small file, just 168 records, but each one pairs a real email address with a plaintext password and the URL of the site it unlocks.

Why This Is Dangerous

Size doesn't determine risk here. Each of the 168 entries in this file is a working login an attacker can try immediately, no cracking or guessing required. For the people affected, a file this small is just as capable of leading to a compromised account as a leak involving millions of records.

What Was Exposed in the Hotmails Leak

• Email addresses
• Plaintext passwords
• URLs showing the associated login pages

Why This Matters: Small Leaks Still Enable Credential Stuffing

Criminals rarely rely on a single small file like this one in isolation. Instead, they combine dozens or hundreds of small combolists into larger credential-stuffing campaigns, testing each email and password pair against multiple sites at once. If any of these 168 people reused their Hotmail password on another account, that account is exposed to takeover, identity theft, or fraud as well.

How Small Combolists Like This Get Made and Shared

Even modest combolists like "hotmails" typically come from recycled breach data, phishing pages, or malware-infected devices, gathered and shared informally on Telegram. Files this size are often uploaded quickly and casually by individual users rather than organized sellers, but the credentials inside are just as real and just as usable by anyone who downloads them.

Check If You Are Affected

Even a small leak like this one can put your accounts at risk. HEROIC's free breach scanner checks your email address against more than 400 billion leaked records, so you can confirm quickly whether your information appears in this file or any other breach.