One Combo File, 16,552 Hotmail Logins: The HQ Combo9 Leak

In November 2024, HEROIC analysts identified a combolist titled "HQ Hotmail combo9" uploaded to a Telegram channel by a user going by "hqhotmailcomboowner." The file contains 16,552 records, each pairing a Hotmail or Outlook email address with a plaintext password and a linked URL. Why This Is Dangerous This is one of the larger combolists HEROIC has tracked from recent Telegram uploads, and every credential in it is plaintext, ready to use without any cracking. Because the list is focused on Microsoft email accounts, a working password can give an attacker access not just to email, but to any other Microsoft service tied to that account, including cloud storage and device sync settings. What Was Exposed in the HQ Hotmail Combo9 File Email addresses (Hotmail and Outlook) Plaintext passwords URLs linked to each login Why This Matters A Microsoft account often functions as a recovery method for other accounts, banking apps, shopping sites, and social media all lean on email for password resets. With over 16,000 working or previously-working credentials in one file, attackers can run credential stuffing attacks at scale, and every successful login becomes a potential doorway to identity theft or financial fraud far beyond the original email account. How Provider-Specific Combolists Like This Get Built Lists labeled by provider, like this Hotmail-focused combo, are usually created by sorting larger, mixed-source breach data down to just the addresses matching one domain. Being labeled "HQ," short for high quality, signals the uploader claims these credentials were tested and confirmed to still work, which typically makes a file like this more valuable and more dangerous than an unverified dump of the same size. Check If You Are Affected If you use a Hotmail or Outlook address, it's worth checking whether your login appears in this file or others like it. HEROIC's free breach scanner searches more than 400 billion leaked records to tell you instantly if your email has been exposed, so you can secure your account before someone else logs in first.