Who’s Targeted by the Outlook 05.09 Leak? 180,174 Users Affected

HEROIC analysts identified a combolist named "outlook 05.09" that was uploaded to a Telegram channel and traces back to a leak dated December 14, 2022. The file contains 180,174 records of email addresses, plaintext passwords, and the URLs associated with each login, with a focus on Outlook and related Microsoft accounts. Why this is dangerous: Outlook accounts are often the master key to a person's digital life, connected to password resets for banking, shopping, and social media. A list of 180,174 plaintext email and password pairs gives an attacker everything needed to log straight in, no password cracking required, and from there, reset access to nearly every other account tied to that inbox. What was exposed in the "outlook 05.09" combolist: email addresses, primarily Outlook and Microsoft accounts, plaintext passwords, and the URLs of the services each login was used on. Why this matters: email inboxes are the gateway accounts of the internet. Anyone who gains access to an Outlook inbox can intercept password reset links for banking, shopping, and social accounts, effectively taking over a person's entire online identity. With 180,174 records in circulation, the scale here is large enough that automated credential stuffing tools could work through the entire list in a short amount of time, testing each login against Outlook itself and other popular sites. How a combolist like this one comes together: a combolist like "outlook 05.09" is typically stitched together from older breaches, phishing campaigns, and malware logs, then filtered so that every entry is an Outlook or Microsoft account. Criminals prize these focused, single-provider lists because they can be used directly against Outlook's login page, or resold to other buyers who specialize in email account takeover. Check if you are affected: if you use an Outlook, Hotmail, or other Microsoft email account, it's worth checking whether your credentials appear in this leak. HEROIC's free breach scanner checks your email against more than 400 billion leaked records so you can see your exposure and lock down your account before someone else logs in first.