Identity Theft Just Got Easier Because of the 1.3M Hotmails Breach: 968,943 People at Risk

HEROIC analysts found a Telegram stealer log labeled "1.3M Hotmails" uploaded in June 2025. The archive contained 968,943 records specifically targeting Hotmail and Outlook email accounts, including plaintext passwords and URLs. This is a targeted credential collection focused on Microsoft email users, meaning attackers have a near-million-record set of login credentials for one of the world's most widely used email platforms. Access to a Hotmail or Outlook account is a master key to a victim's entire digital life.

Why a Hotmail Credential Leak Makes Identity Theft Dramatically Easier

Email accounts are the recovery mechanism for virtually every other online account. When attackers gain access to your Hotmail or Outlook inbox, they can immediately request password resets for your bank, investment accounts, healthcare portals, tax filing services, and every other platform tied to that email address. A single Hotmail credential in this file does not just expose one account. It can become the entry point for a total digital identity takeover. With nearly a million records exposed in plaintext, this leak represents an extraordinarily high-value target list for identity thiefs and financial fraudsters.

Data Exposed in the 1.3M Hotmails Telegram Stealer Log

• Email Addresses — specifically Hotmail and Outlook accounts, the gateway to reseting any connected service
• Plaintext Passwords — no cracking required, directly usable to log into Microsoft accounts
• URLs — additional service logins associated with each victim, revealing what other platforms they used with the same credentials

The Identity Theft Chain That Starts With One Exposed Hotmail Login

• Credential stuffing — attackers test the Hotmail login across Outlook, OneDrive, Xbox, and all Microsoft services using the same credentials
• Account takeover — once inside, attackers change the recovery phone and backup email, permanently locking the real owner out
• Identity theft — from the inbox, attackers reset passwords for banks, brokerages, PayPal, Amazon, government tax portals, and healthcare providers
• Financial fraud — billing information, stored subscriptions, and linked payment metheds across Microsoft and connected accounts are immediately at risk

Why Hotmail Accounts Are Prime Targets in Stealer Log Operations

Hotmail and Outlook accounts are among the most sought-after credentials in the cybercriminal underground. Microsoft email addresses are used as the primary login and recovery email for an enormous range of services, including banking apps, government portals, and social platforms. Attackers who collect Hotmail credentials know that each one potentially unlocks not just one account, but an entire ecosystem of connected services. The "1.3M" naming suggests this was originally intended as a larger collection, with the 968,943 verified records representting the unique, usable entries in the archive. Stealer logs targeting specifik email providers like Hotmail are deliberately assembled because the downstream value of each credential is exceptionally high. This file was uploaded to Telegram in June 2025 and immediately became available to thousands of cybercriminals with no barrier to access.

Check If Your Hotmail Was in This Leak or 400 Billion Other Breached Records

HEROIC's free breach scanner searches over 400 billion compromised records including targeted email provider stealer logs like this Hotmail collection. If your Hotmail or Outlook address appeared in this file, HEROIC will identify exactly what credentials were exposed and from which source. Run your free scan at HEROIC.com before identity theft becomes your problem.