Inside the hotmail.fr Combolist: How 192,890 Credentials Leaked Online

Inside the hotmail.fr Combolist

In June 2026, HEROIC analysts identified a combolist focused on hotmail.fr accounts circulating on Telegram. The file contained 192,890 records, each pairing an email address with a plaintext password and the URL where the login was used.

Why a Provider-Focused Leak Like This Spreads Fast

Grouping nearly 193,000 credentials under a single email provider makes the file easy for attackers to test using automated tools built for that platform's login page. That efficiency is part of why provider-specific combolists like this one circulate quickly once they appear.

What Was Exposed in the hotmail.fr Combolist

• Email addresses
• Plaintext passwords
• URLs tied to each credential pair

Why This Matters

Because email accounts are often used to reset passwords elsewhere, a compromised hotmail.fr login can open the door to other accounts tied to that inbox. That makes this leak a starting point for credential stuffing, account takeover, identity theft, and financial fraud, not just a risk to the email account itself.

How This Combolist Was Compiled

Combolists like this one are usually built by pulling matching credentials from stealer logs and older breaches, filtering for a specific email provider, in this case hotmail.fr, and combining the results into one file before it circulates through Telegram groups.

Check If You Are Affected

Use HEROIC's free breach scanner to check your email against more than 400 billion leaked records, including this hotmail.fr combolist, and find out if your password needs to change.