Urgent: Hotmails Untested Mrbouliz Leaks 12,429 Passwords

Urgent: The Hotmails Untested Mrbouliz Combolist Leak

HEROIC analysts identified a combolist titled "Hotmails Untested mrbouliz" that was uploaded by a Telegram user on 4 July 2026. The file contains 12,429 records of email addresses and plaintext passwords, along with associated URLs, tied to accounts in the United States.

Why This Is Dangerous

The passwords in this file are stored in plaintext, so an attacker does not need any special tools to use them right away. With over 12,000 email and password pairs available, someone can immediately attempt to log into thousands of Hotmail accounts, take over inboxes, and use them to reset passwords or scam contacts before victims even know they are exposed.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

A leak of this size is exactly what powers large-scale credential stuffing, where attackers run automated tools that test each stolen email and password combination against banking sites, shopping accounts, and social media. Because so many people reuse passwords, this single combolist can lead to account takeover, identity theft, and financial fraud far beyond the original Hotmail accounts.

How Combolists Work

A combolist is a file that pairs stolen usernames or email addresses with matching passwords, compiled from multiple sources and labeled "untested" when the seller has not yet verified which logins still work. Buyers on Telegram often purchase untested lists at a lower price and run their own checks, meaning a 12,429-record file like this one can still cause real damage even before every credential is confirmed.

Check If You Are Affected

Do not wait to find out if you are on this list. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records in seconds, so you can confirm your exposure and change your password immediately if needed.