The outlook.de Breach Happened Earlier. The Data Just Went Public.

HEROIC analysts dated a combolist named "outlook.de" to December 2024, though the file only surfaced publicly on Telegram more recently. It contains 969 records pairing outlook.de email addresses with plaintext passwords and the URLs those credentials access.

Why This Is Dangerous

There's often a gap between when credentials are actually stolen and when they show up in a public or semi-public dump like this one. That gap works against victims: the longer a password sits in criminal hands unnoticed, the more time attackers have to test it quietly before anyone thinks to change it.

What Was Exposed

• outlook.de email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

An outlook.de account often doubles as a recovery email for other services, so a compromised login here can ripple outward into other accounts. Combined with password reuse, a delayed discovery like this one gives attackers a longer runway to attempt credential stuffing before victims react.

How Combolists Work

Combolists are built by combining credentials from multiple sources, older breaches, phishing pages, and stealer malware, into a single file organized around a theme, in this case the outlook.de email domain. That organization makes it easy for a buyer to target German Outlook users specifically rather than sifting through a mixed, unsorted list.

Check If You Are Affected

Run your email address through HEROIC's free breach scanner, checking against more than 400 billion compromised records, to see whether your outlook.de account is included in this leak.