If You Reuse Passwords, the Hotmail UHQ Leak Should Worry You

HEROIC analysts identified a combolist labeled "Hotmail UHQ 2" circulating on a Telegram channel in April 2023. The file paired 99,997 email addresses with plaintext passwords and the URLs of the sites those logins belong to, the standard format attackers use to automate login attempts across the web.

Why the Hotmail UHQ Combolist Is Dangerous

A combolist is not a puzzle an attacker has to solve. The passwords in this file were stored in plaintext, meaning anyone who downloads it can copy an email and password pair and try logging in immediately, no cracking or guessing required. When the URL field is included, the attacker also knows exactly which site or service each credential pair unlocks, which speeds up automated attacks even further. With almost 100,000 pairs in a single file, this is exactly the kind of list attackers load into automated tools rather than testing by hand.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each credential pair to its original login page

Why This Matters

If you reuse passwords across accounts, a leak like this one is exactly why it catches up with people. Anyone whose email and password appear in the Hotmail UHQ file faces a real risk of credential stuffing, where automated tools feed leaked logins into hundreds of websites at once looking for a match. Because the login here is a webmail account, a successful match also hands the attacker the ability to reset passwords on nearly every other account tied to that inbox.

How Combolists Like This One Are Built

Combolists are compiled by merging credentials pulled from older breaches, phishing kits, and malware logs into a single searchable file, then formatted as email:password or email:password:URL so they can be fed straight into automated login tools. They are traded and sold cheaply on Telegram and dark web forums because they let low-skill attackers run large-scale login attempts with almost no technical effort. A file's age does not make it safe. Old combolists still work against anyone who has not changed the password since.

Check If You Are Affected

You do not have to guess whether your information is sitting in a dump like this one. HEROIC's free breach scanner checks your email address against more than 400 billion leaked records pulled from combolists, stealer logs, and dark web marketplaces. Run a free scan, and if a match turns up, change that password everywhere else you have used it.