If You Use Hotmail, the 300K UHQ Combolist Leak Should Worry You

In July 2026, HEROIC analysts found a large combolist circulating on Telegram called 300K UHQ Hotmail Combolist. The file contained 242,881 records pairing Hotmail email addresses with plaintext passwords, along with the URLs those credentials were originally tied to.

Why the 300K UHQ Hotmail Combolist Is Dangerous

Because every password in this file is stored in plaintext, anyone who downloads it can read the exact password for each Hotmail account with no extra work. With 242,881 accounts in a single file, an attacker has a ready made list to run against Hotmail itself, plus any other site where the same email and password might have been reused.

What Was Exposed in the 300K UHQ Hotmail Combolist

• Hotmail email addresses
• Plaintext passwords
• URLs linked to each set of credentials

Why This Matters for Hotmail Users

A combolist this size is exactly what criminals use for credential stuffing, feeding all 242,881 email and password pairs into automated tools that test them against Hotmail, banking sites, and online shopping accounts. If you use Hotmail and have ever reused that password anywhere else, this leak puts those other accounts at risk of takeover, financial fraud, or identity theft.

How a Hotmail Combolist Like This One Gets Built

A combolist is a plain text file pairing usernames or emails with passwords, usually pulled together from older breaches, phishing pages, or malware infections and filtered down to one email provider, in this case Hotmail. UHQ stands for "ultra high quality," meaning the uploader claims the credentials have been checked and are likely to still work. Telegram is a common place for sellers to distribute lists like this to buyers quickly and with little oversight.

Check If You Are Affected

If you have a Hotmail account, HEROIC's free breach scanner checks your email address against a database of more than 400 billion exposed records, including this combolist. Run a scan now to see if your credentials are part of this leak, and change your password immediately if you find a match or have reused it elsewhere.