NuggetCloudHotmails Leak Raises Identity Theft Risk for 115 Accounts

On 27-Apr-2026, HEROIC analysts identified a combolist titled NuggetCloudHotmails shared on Telegram. The file contains 115 email and plaintext password pairs tied to Hotmail accounts, along with the URL for each login.

Why This Is Dangerous

Because this list focuses specifically on Hotmail accounts, an attacker has a working email and password pair matched to the exact login page for each of the 115 records. No guessing is required, only a quick attempt with the credentials already provided.

What Was Exposed

• Email addresses (Hotmail)
• Plaintext passwords
• URLs for each affected login

Why This Matters

A compromised Hotmail account can quickly turn into a much bigger problem, since email inboxes are commonly used to reset passwords on banking, shopping, and social media accounts. If your address is among these 115 records, an attacker could use it as a stepping stone into other accounts, raising your risk of identity theft.

How Combolists Work

A combolist is built by collecting email and password pairs from older breaches and stealer logs, then narrowing them down to a specific target, in this case Hotmail users. Each pair is tested with automated checker tools to confirm it still logs in before being packaged into a list like "NuggetCloudHotmails" and shared on Telegram.

Check If You Are Affected

If you have a Hotmail account, checking your exposure takes seconds. HEROIC's free breach scanner checks your email against more than 400 billion exposed records, including this combolist, so you can confirm whether you're affected and update your password.