NINHO Private Hotmail Combolist Exposes Exactly 599 Logins

On 3 June 2026, a combolist titled "NINHO PRIVATE HOTMAIL" surfaced on Telegram. HEROIC verified the file contains precisely 599 records of email addresses, plaintext passwords, and associated URLs, all associated with Hotmail-style accounts.

Why This Is Dangerous

The word "Private" in the file name suggests the uploader is trying to sell exclusive access to these 599 credentials rather than freely distributing them, which often means the data hasn't been widely circulated or checked by defenders yet. Combined with plaintext passwords, that gives an attacker a head start before victims have any reason to suspect a problem.

What Was Exposed

The "NINHO PRIVATE HOTMAIL" combolist contains:

• Email addresses (Hotmail-associated)
• Plaintext passwords
• Associated URLs

Why This Matters

Hotmail accounts frequently serve as the recovery point for other logins, so a compromised inbox can quickly turn into a compromised bank account, shopping account, or social media profile. Anyone among these 599 records faces a real risk of account takeover and identity theft if they reused their password elsewhere.

How This Combolist Was Built

"Private" combolists like this one are usually sold directly to a small number of buyers rather than posted publicly, which is meant to increase their value and reduce the chance that the targeted accounts get flagged or reset before the buyer can use them. The credentials themselves are typically gathered from previous breaches, phishing campaigns, or malware infections.

Check If You Are Affected

If you use a Hotmail or Outlook account, don't assume you're safe just because this list is labeled "private." HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including this combolist, so you can find out for certain.