Inside ‘hotmails_mix500x_part1’: How 500 Logins Leaked

On 25 Apr 2026, a combolist file named "hotmails_mix500x_part1" was uploaded to a Telegram channel. HEROIC analysts confirmed the file contains 500 records, each pairing an email address with a plaintext password and the login URL the credential unlocks.

Why This Is Dangerous

Because every password inside "hotmails_mix500x_part1" is stored as plain, readable text, there is nothing standing between whoever finds the file and a working login. No decryption, no guessing, no specialized tools, just a direct copy-and-paste into the matching site.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

A file of 500 working email and password pairs is exactly the kind of raw material credential-stuffing attacks are built on. Criminals load the list into automated software that tests each pair against banking sites, retailers, and social platforms, hoping the victim reused the same password elsewhere. Because so many people do, a single exposed Hotmail login can lead to identity theft and financial fraud far beyond the original account.

What "part1" Reveals About How Combolists Are Built

The label "part1" is a telling detail: it means this 500-record file is only a fragment of a much larger batch of stolen Hotmail credentials that was split into smaller pieces before being uploaded. Splitting large dumps into numbered parts makes them easier to share, download, and distribute across Telegram channels, and it suggests more segments of the same collection may exist or follow. Combolists like this are typically assembled from older breaches, phishing campaigns, and malware logs, then split, filtered, and packaged for distribution.

Check If You Are Affected

If part of a larger Hotmail credential dump is circulating, it is worth confirming whether your email is among the 500 records already exposed, and whether it might appear in a future part of the same collection. HEROIC's free breach scanner checks your email against more than 400 billion compromised records and tells you instantly if you have been affected. Run a free scan now to stay ahead of the next release.