Inside the Outlook.com Combolist Leak: 2,044 Logins Exposed

In March 2026, HEROIC analysts found a combolist file circulating on Telegram, labeled "2.179 lines outlook.com" and uploaded by a Telegram user. The file contained 2,044 records pairing email addresses with plaintext passwords and related URLs, focused on Outlook.com style login credentials.

Why This Outlook.com Combolist Leak Is Dangerous

Every password in this file sits in plaintext, so anyone who downloads it can read the credentials instantly without cracking anything. Because email accounts like Outlook are often used to reset passwords on other services, a compromised inbox can act as a master key to someone's banking, shopping, and social media logins.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

If your email and password appear in this file, an attacker can log straight into your inbox and anywhere else you reused that password. From there, credential stuffing attacks can spread to other accounts, opening the door to identity theft and financial fraud, especially if that email address is the recovery contact for your bank or other sensitive accounts.

How Combolists Like This Get Built

A combolist is a collection of email or username and password pairs, often assembled from older breaches, phishing pages, or malware infections rather than a single new hack. Files like this one, organized around a specific email provider, are traded on Telegram channels because attackers can quickly filter and target one type of account. The included URLs typically point to the exact login pages the credentials were used on.

Check If Your Outlook Login Was Exposed

If you want to know whether your email address shows up in this combolist or any other leaked dataset, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. It takes seconds to check, and if you find a match, updating that password everywhere you have reused it closes the gap fast.