100,000 Hotmail.ca Accounts Exposed in MALIST Combolist Leak

HEROIC analysts found a combolist file named "MALIST 100K HOTMAIL.CA FRESH CRACKER_COMBO_MAIL_ACCESS" uploaded to Telegram, containing exactly 100,000 records. Unlike a mixed leak pulled from many different services, this file is specifically built around Hotmail.ca email accounts, pairing each address with a plaintext password and the URL used to access it.

Why This Is Dangerous

Because this list is focused entirely on one email provider, it is far more useful to an attacker than a scattered mix of logins. Anyone using this file already knows every entry is a Hotmail.ca account, and since the passwords are stored in plaintext with the matching URL included, there is nothing standing between them and a working login.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to the original accounts

Why This Matters

A Hotmail.ca inbox is often connected to other Microsoft services and used to receive password reset links for banking, shopping, and social media accounts. An attacker who gains access can use it as a launchpad for credential stuffing across those linked accounts, quickly turning a single email takeover into a chain of compromised services, identity theft, or financial fraud.

How a Combolist Leak Works

A combolist like this one is built by collecting login pairs, usually formatted as email:password, then testing and sorting them by the email provider they belong to, labeling the resulting file so buyers know exactly what they are getting. Once labeled "fresh" and "cracked," the file is posted to a channel like this, ready to be used against the accounts it targets right away.

Check If You Are Affected

If you use a Hotmail.ca address, it is worth checking whether it appears in a targeted list like this one. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including combolists like this, so you can find out quickly and secure your account.