Microsoft Combo Leak Put 709,834 Stolen Logins Online

In early February 2023, HEROIC analysts identified a stealer log posted to Telegram titled "850k Microsoft Combo Private 100," containing 709,834 exposed records tied to Microsoft accounts. Each record pairs an email address with a plaintext password and the URL of the login page it opens, the standard structure of data harvested by infostealer malware from an infected browser.

The Microsoft Combo Leak Put Stolen Logins Online

Despite the file's name promising 850,000 entries, HEROIC's analysis found 709,834 usable records, still a massive collection of Microsoft account credentials sitting in plaintext and available to anyone who obtains the file. A combo list like this pairs email addresses directly with working passwords, built specifically so attackers can plug them straight into a login form.

What Was Exposed in This Microsoft Combo List

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

Microsoft accounts often connect to email, cloud storage, Office documents, and Windows device sign-ins, so a single stolen password can expose far more than an inbox. With over 700,000 credentials in this file, attackers can run automated credential stuffing attempts across other services, and anyone who reused their Microsoft password elsewhere faces a real risk of account takeover and identity theft.

How This Combo List Was Built

Combo lists like this one are typically assembled from stealer malware logs collected across many infected devices, then filtered and labeled as private to suggest exclusivity before being sold or traded. Labels like private and numbered tags are common marketing terms sellers use on Telegram to make a stolen credential list sound more valuable to buyers.

Check If You Are Affected

With more than 700,000 Microsoft-linked credentials in this one file, checking your exposure takes only a moment. HEROIC's free breach scanner searches a database of more than 400 billion compromised records so you can confirm in seconds whether your email and password appeared in this leak.