If You Reuse Passwords, the UHQ Hotmail Leak Should Worry You

HEROIC has identified a stealer log file titled UHQ Hotmail Combo circulating on Telegram that contains 2,985 compromised records. Labeled as "ultra high quality" by the threat actor who compiled it, this dump targets Hotmail users and includes verified email addresses, plaintext passwords, and the URLs of services where these credentials were entered.

Unencrypted Passwords Available to Anyone

All 2,985 passwords in this collection are stored without any encryption or hashing. They appear exactly as each user originally typed them. This means any individual who accesses the stealer log has immediate, unimpeded access to the listed accounts and can begin testing those same credentials against other services within seconds.

What Was Exposed

• Hotmail email addresses curated for verified access
• Plaintext passwords captured during active login sessions
• URLs revealing the specific services and portals where credentials were used

Your Hotmail Password Probably Protects More Than Your Email

Most people use their Hotmail address as the primary recovery email for banking, shopping, and social media accounts. When that same password is reused across services, a single leaked credential becomes a skeleton key. Attackers exploit this through credential stuffing, systematically testing each pair against dozens of high-value targets until they find a match.

From Malware Infection to Public Credential Dump

These credentials were harvested by infostealer malware that infected victim devices undetected. The malware captured passwords saved in browsers, intercepted form submissions, and recorded session data. The compiled data was then shared through Telegram channels, where files labeled "UHQ" attract attention because they imply the credentials have been tested and verified as working.

Check If Your Credentials Were Exposed

Hotmail users should not assume they are unaffected simply because of the relatively small size of this dump. Search your email address with the HEROIC breach scanner, which indexes more than 400 billion compromised records, to discover whether your credentials appear in this or any other known breach. Changing compromised passwords immediately is the most effective defense.