One Telegram Upload, 7,174 Logins: The 8K Hotmail Combo Leak

In September 2024, HEROIC analysts found a combolist called "8K HOTMAIL COMBO" uploaded to a Telegram channel. Despite the "8K" in the name, the file contains 7,174 verified records, each pairing an email address with a plaintext password and a linked URL. Why This Is Dangerous Every credential in this file is stored in plaintext, meaning no cracking or effort is needed to use it. Because the list is built almost entirely from Hotmail and Outlook addresses, it's especially useful to attackers running automated login attempts against Microsoft's ecosystem, where a single working password can unlock email, cloud storage, and any other Microsoft account tied to it. What Was Exposed in the 8K Hotmail Combo Email addresses (primarily Hotmail and Outlook) Plaintext passwords URLs linked to each login Why This Matters A Microsoft email account is often the master key to a person's digital life, it's frequently used to reset passwords for banking, shopping, and social media accounts. With 7,174 working or previously-working Hotmail credentials in one file, attackers can run credential stuffing attacks at scale, and each successful login opens the door to identity theft, financial fraud, and further account takeovers using that inbox's password reset links. How Combolists Like This Get Built and Sold Combo files targeting one specific email provider, like this Hotmail-focused list, are usually created by filtering larger breach dumps or stealer logs down to just the addresses that match a certain domain. That makes them more valuable to buyers who specialize in attacking a single platform. Once filtered, the list gets uploaded to Telegram, sometimes for free to build a reputation, sometimes sold to other criminals. Check If You Are Affected If you use a Hotmail or Outlook account, it's worth checking whether your credentials appear in this or a similar leak. HEROIC's free breach scanner searches over 400 billion leaked records to tell you instantly if your email has been exposed, so you can change your password before someone else uses it.