NINHO Private Hotmail Stealer Log Exposes Exactly 622 Records

In late May 2026, HEROIC analysts identified a stealer log dump called "NINHO PRIVATE HOTMAIL" uploaded to a Telegram channel by an anonymous user. The file contained exactly 622 records tied to United States based accounts, made up of email addresses, plaintext passwords, and the URLs of the sites those credentials were used on.

Why This Is Dangerous

Each of the 622 entries in this file pairs a plaintext password with the exact site it was used on, which means there is no encryption to break and no guessing required. Anyone who obtains the file can read the credentials directly and attempt to log in immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login sites

Why This Matters

A set of 622 working credentials is enough to make automated credential stuffing worthwhile for attackers, who test each email and password combination against email providers, banks, and shopping sites in case the same password was reused elsewhere. If a compromised account happens to be an email address, an attacker can use it to reset passwords on other services, extending the impact of this leak into broader identity theft or financial fraud.

How Stealer Logs Work

Stealer logs are the output of infostealer malware, which infects a device through pirated downloads, cracked software, or malicious attachments, then quietly collects saved usernames, passwords, and browsing URLs from the browser. The resulting file is typically shared on Telegram channels or dark web forums, exactly as this one was, giving criminals a precise, ready-to-use list of 622 credential sets.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including this stealer log. Run a search today to find out whether you are among the 622 people affected, and update any passwords that show up as exposed.