Identity Theft Got Easier: The ’48K Hotmail’ Leak Hit 47,679 Accounts

47,679 Hotmail Accounts Exposed in the "48K Hotmail Combolist"

On May 25, 2026, HEROIC analysts found a combolist labeled "48K HOTMAIL Combolist 05-24" circulating in a private Telegram channel, targeting Hotmail and Outlook accounts. The file contained 47,679 records pairing email addresses with plaintext passwords, along with URLs identifying the site each credential was captured from.

Why This Combolist Is Dangerous

Because this list is filtered to a single email provider and stored in plaintext, an attacker has a large, ready-made set of Hotmail and Outlook accounts to target immediately. Email accounts are often used to verify identity and reset passwords elsewhere, so gaining access to one can open the door to several other accounts belonging to the same person.

What Was Exposed in the "48K Hotmail Combolist"

• Hotmail and Outlook email addresses
• Plaintext passwords
• URLs tied to each credential pair

Why This Matters: Identity Theft Gets Easier

With nearly 48,000 working email and password combinations in one file, attackers can automate password reset requests, intercept account recovery emails, and impersonate victims across multiple services. If your Hotmail or Outlook account appears here, and especially if you have reused that password, you face a heightened risk of identity theft, account takeover, and financial fraud.

How Provider-Specific Combolists Like This Are Built

Attackers frequently sort large stolen credential collections by email domain, isolating Hotmail, Gmail, Yahoo, and other providers into separate combolists that are easier to sell and target. These filtered files circulate in private Telegram channels, where buyers run automated login attempts against the matching email provider and any other site tied to the leaked URLs.

Check If You Are Affected

If you use a Hotmail or Outlook address, HEROIC's free breach scanner checks your email against a database of more than 400 billion exposed records. Run a scan now to see if your credentials appear in this leak or any other breach, and update your password if they do.