Mail Access 253 Hits: Hotmail Logins Leaked Since Aug 2025

HEROIC analysts identified a small stealer log dump, titled "MAIL ACCESS 253 HITS HOTMAIL VALID," posted to a Telegram channel on August 20, 2025. The file contains 214 records, each pairing an email address with a plaintext password and the URL of the account it unlocks. The name given to the file by its uploader, referencing "253 hits" and "valid" Hotmail logins, suggests the credentials had already been tested and confirmed to work before the list was shared, which is a common practice among criminals trading small batches of stolen logins.

Why This Is Dangerous

Even though this is a small file compared to larger breaches, every one of the 214 records includes a working, plaintext password tied to a specific email account, with the site URL included. That combination means an attacker does not need to guess or crack anything to access these accounts. Because the listing markets the credentials as already verified as "valid," anyone who buys or downloads the file can move straight to logging in rather than testing a large batch of unconfirmed logins.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the websites where the credentials were used

Why This Matters

For the 214 people in this file, the main risk is direct account takeover of Hotmail and any other accounts tied to the same password. Email accounts are especially sensitive because they are often used to reset passwords for other services, so gaining access to one can give an attacker a path into banking, shopping, and social media accounts as well. If the password was reused anywhere else, the risk extends further through credential stuffing attempts on other sites.

How Stealer Logs Work

A stealer log is created by infostealer malware that infects a victim's computer, often through a pirated download or malicious attachment, and then quietly collects saved passwords, autofill data, and browsing details from the browser. Criminals frequently sort these logs by the type of account found, in this case Hotmail logins, and label smaller, pre-verified batches like this one as "hits" to signal to buyers that the credentials have already been confirmed to work. These curated lists are then distributed through Telegram channels dedicated to trading stolen account access.

Check If You Are Affected

If you use a Hotmail account and want to know whether your login appears in this or another leaked file, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. It takes only a moment to search and can help you catch an exposed password before it is used against you.