The NINHO PRIVATE HOTMAIL Combolist Exposed 2,208 Login Pairs Online

HEROIC analysts identified a combolist named NINHO PRIVATE HOTMAIL, uploaded by a Telegram user on 26 June 2026. The file contains 2,208 records of Hotmail and Outlook email addresses paired with plaintext passwords and the URLs of the login pages they belong to.

Why This Is Dangerous

This is a focused list built entirely around Hotmail and Outlook accounts, which means every entry gives an attacker a working email address and its exact password, ready to try immediately. Because the file is marketed as "private," it likely has not been widely resold or tested yet, making the credentials inside it more valuable and more likely to still be active.

What Was Exposed

• Hotmail and Outlook email addresses
• Plaintext passwords
• URLs of the login pages tied to each account

Why This Matters

An email account is often the recovery point for banking apps, shopping accounts, and social media logins. Anyone who accesses one of these 2,208 Hotmail accounts can intercept password reset emails and take over other services tied to that inbox. Reused passwords compound the damage far beyond the original account.

How Combolists Work

Combolists like this one are built by collecting email and password pairs from stealer logs, older breaches, or phishing campaigns, then sorting them by email provider or target site to make them easier to sell and use. Attackers run these lists through automated login tools that test each pair against the real service in bulk. A private combolist usually means it is being sold or shared in a smaller, closed circle before wider distribution.

Check If You Are Affected

HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including combolists like this Hotmail-focused batch. Run a free search and update any passwords tied to accounts that show up.