If You Reuse Passwords, the Hotmails 4 Leak Should Worry You

In January 2025, HEROIC's analysts identified a small combolist titled Hotmails 4 uploaded to Telegram, focused specifically on Hotmail and Outlook email accounts. The file contains 727 records, each pairing an email address with a plaintext password and the URL of the login page it was used on.

Why the Hotmails 4 Leak Is Dangerous

Because these passwords are stored in plaintext and specifically target Hotmail and Outlook accounts, anyone who downloads Hotmails 4 can immediately attempt to log into each listed inbox. Email access is especially valuable to attackers because it can be used to reset passwords on nearly every other account tied to that address.

What the Hotmails 4 Combolist Contains

• Email addresses
• Plaintext passwords
• URLs of the websites each credential unlocks

Why This Leak Matters to You

A small file size does not mean small risk. If your Hotmail or Outlook password reused elsewhere appears in this list, an attacker who gains access to your inbox can chain that access into your banking, shopping, and social media accounts by requesting password resets sent straight to the compromised email.

How the Hotmails 4 Combolist Was Assembled

Combolists like Hotmails 4 are usually built by filtering larger, mixed credential dumps down to a single email provider, making them easier for buyers who specialize in targeting one type of account. The "4" in the file name suggests this is at least the fourth such list released by the same uploader.

Check If You Are in the Hotmails 4 Leak

Check for free whether your email address appears in Hotmails 4 or any of the more than 400 billion leaked records in HEROIC's breach database. If you're affected, change your password immediately and turn on two-factor authentication on your email account right away.