Outlook Combolist ‘29.09’ Leaked 7,326 Email and Password Pairs

In May 2023, HEROIC analysts identified a combolist titled "Outlook 29.09" that a Telegram user uploaded, exposing 7,326 records. Tied to a leak date of May 7, 2023, the file pairs Outlook-associated email addresses with plaintext passwords and the URLs they unlock. Why This Is Dangerous: This file is built specifically around Outlook accounts, giving an attacker a focused, ready-to-use list of Outlook logins. Because the passwords are stored in plaintext, whoever has the file can read and try each one immediately, no extra work required. What Was Exposed: - Outlook-linked email addresses - Plaintext passwords tied to those accounts - URLs showing which site or service each credential pair unlocks Why This Matters: Outlook accounts frequently double as the recovery email for banking apps, shopping sites, and workplace logins. If an attacker gains access to your Outlook inbox, they can reset passwords elsewhere, read sensitive messages, or use your account to send convincing phishing emails to your contacts. Reused passwords make it easy for attackers to turn one leaked Outlook login into several compromised accounts through credential stuffing. How a Combolist Like This Works: A combolist compiles stolen email-and-password pairs, sometimes organized around a specific email provider, in this case Outlook, so attackers can run focused campaigns against that platform. These files circulate through Telegram channels where automated tools test each pair against login pages until a match is found. Check If You Are Affected: Even a smaller leak like this one is worth checking. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, so you can confirm in seconds whether your Outlook credentials were exposed and change your password if needed.