One Stealer Log. 345 Records. The 345X Hotmail Credentials.

HEROIC analysts identified this stealer log on May 23, 2026. The breach exposed 345 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as 345X Hotmail.

Why This Is Dangerous

This stealer log specifically targets Hotmail accounts, capturing email addresses and plaintext passwords from Microsoft email users. A compromised Hotmail account gives attackers access to a widely used email platform that is often linked to Microsoft services, OneDrive storage, Xbox accounts, and subscription services like Microsoft 365.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs (website addresses where credentials were stolen)

Why This Matters

Even though this breach contains 345 records, each represents a real Hotmail user whose email account may be open to takeover. A compromised email account is particularly damaging because it can be used to reset passwords on banking, social media, and subscription services. Criminals with access to someone's Hotmail inbox can intercept password reset emails and systematically take over every linked account.

How Stealer Logs Work

Stealer malware infects computers through phishing emails disguised as legitimate messages, fake software downloads, or malicious websites. Once installed, the malware extracts saved passwords from the browser and records credentials as the user logs in. Hotmail and other Microsoft email credentials are common targets. Collected data is packaged into files and circulated through private Telegram channels.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to see if your credentials appear here or elsewhere. Free, takes seconds.