Hotmail Users Targeted in the 672-Account HQ Hotmails Private Leak

In late March 2026, HEROIC analysts found a combolist titled 'HQ Hotmails Private' uploaded to a Telegram channel by an individual user. As the name suggests, this list specifically targets Hotmail and Microsoft account holders, containing 672 records that pair an email address with a plaintext password and an associated login URL. Why This Is Dangerous: By focusing on a single email provider, this list gives an attacker a ready-made group of Hotmail users to target with credential stuffing attempts. Because the passwords are stored in plaintext, they can be tested against Microsoft's login page and dozens of other sites immediately, with no extra effort required. What Was Exposed: email addresses; plaintext passwords; associated login URLs. Why This Matters: Hotmail and Outlook accounts are often linked to Microsoft services like OneDrive, Xbox, and Office, as well as used as the recovery email for other accounts. If you're one of the 672 people in this list and you reused your Hotmail password anywhere else, an attacker could use it to reset passwords on other services or access personal files and messages stored in your Microsoft account. How Combolists Work: Lists labeled 'HQ' (high quality) and 'Private' typically mean the credentials were tested and verified as working logins before being packaged for a smaller, more exclusive audience rather than posted publicly right away. Targeting a specific provider like Hotmail lets buyers focus their attacks on accounts they know will accept the same login page. Check If You Are Affected: If you use a Hotmail, Outlook, or other Microsoft email account, it's worth checking now. HEROIC's free breach scanner searches more than 400 billion leaked records for your email address and tells you immediately if your password needs to change.