lines_microsoft Combolist: What Leaked and Who Should Check

Each of the 699,821 records HEROIC analysts found in a combolist called lines_microsoft, dated January 6, 2026, pairs an email address with a plaintext password and the URL that login is tied to. That pairing, despite the file's name, is not evidence of any breach at Microsoft itself, it's simply how this particular combolist was labeled by whoever assembled it. The only way to know if you're affected is to scan your email.

Why the Pairing Makes This File Dangerous

A password by itself tells an attacker little, but paired with the exact URL it unlocks, there's no guesswork involved. That combination is what turns a plain list of passwords into a ready-made set of working logins.

What Was Exposed in the lines_microsoft File

• Email Addresses: identifies a working inbox that can be targeted with phishing or used as a login.
• Plaintext Password: readable immediately, letting anyone test it on other accounts without cracking.
• URLs: shows which site or service each login pair was tied to.

Why a Reused Password Spreads the Risk Further

Since so many people reuse the same password across sites, a single pairing in this file can unlock accounts that have nothing to do with the original source, including email, banking, or workplace logins.

How a Combolist of This Size Gets Built

Large combolists like this one are assembled by merging email and password pairs gathered from many older leaks and malware logs into a single searchable file. HEROIC analysts see files like lines_microsoft circulate and get refreshed on Telegram.

What to Do About the lines_microsoft Leak

Start by scanning your email to check if your address appears in this file. If the password looks familiar, change it everywhere you've reused it and set a unique password for each account going forward. This applies to personal and work email alike.