2,697 live.com Passwords Leaked: What This Stealer Log Exposed

2,697 live.com Records Found in a Telegram Stealer Log

On 23 June 2026, HEROIC analysts identified a stealer log uploaded to a Telegram channel containing 2,697 records tied to live.com, Microsoft's webmail service. Each record includes an email address, a plaintext password, and the exact login URL where that password was entered, all pulled directly from infected devices by information-stealing malware rather than from any breach at Microsoft.

Why Nearly 2,700 Exposed Passwords Is a Real Problem

A live.com or Outlook account is often the key to a person's digital life: it can be used to reset passwords on banking, shopping, and social media accounts. Because these passwords were stolen in plaintext, anyone holding this log can attempt to log in immediately, with no cracking or decryption needed.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs tied to each live.com account

Why This Puts More Than Email at Risk

Because webmail accounts are frequently used to verify identity and reset other passwords, a compromised live.com login can cascade into credential stuffing across unrelated services, unauthorized account takeover, and in the worst cases, identity theft or financial fraud if linked payment or banking accounts are reachable through the same email.

How Stealer Logs Like This Get Built

Infostealer malware infects a device through a pirated download, cracked software, or malicious attachment, then silently copies every saved browser password, cookie, and autofill entry. Criminals combine these individual infections into a single log, sort the entries by the sites victims logged into, and distribute the results on Telegram, which is how this live.com batch surfaced.

Check If You Are Affected

If you use live.com, Outlook, or Hotmail, or have reused that password elsewhere, check your exposure now. HEROIC's free breach scanner searches more than 400 billion breached and leaked records, including stealer logs like this one, so you can confirm whether your credentials have surfaced.