Search Your Email: Outlook.com Leak Exposed 1,347 Accounts

HEROIC analysts identified a stealer log dataset labeled "outlook.com," uploaded to a Telegram channel on July 31, 2025. The file contains 1,347 records made up of email addresses, plaintext passwords, and the URLs of the sites those credentials were used on, with the naming indicating a focus on Outlook email accounts specifically.

Why This Is Dangerous

An Outlook inbox often connects to far more than just email. It's frequently tied to Microsoft accounts, cloud storage, and other linked services, so gaining access to one of these 1,347 accounts can hand an attacker a foothold into a much wider part of someone's digital life, all without needing to break any encryption since the passwords are stored in plaintext.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites the credentials were used on

Why This Matters

Because these are plaintext credentials tied to active Outlook logins, the immediate risk is direct inbox takeover. From there, attackers can use password reset emails to pivot into banking, shopping, or social media accounts, and if any of these 1,347 people reused their Outlook password elsewhere, credential stuffing attacks extend the risk even further.

How Stealer Logs Work

Stealer logs are generated by infostealer malware that infects a device through phishing links, cracked software, or fake downloads, then silently extracts saved browser passwords, autofill data, and active sessions. Logs are often sorted by email provider, as seen here with the "outlook.com" label, so buyers on Telegram can purchase credentials for a specific platform rather than sifting through a mixed batch.

Check If You Are Affected

If you use an Outlook or Microsoft account, take a moment to check whether your login appears in this leak. HEROIC's free breach scanner searches a database of more than 400 billion exposed records to give you an instant, clear answer and next steps.