Outlook.com Leak Means 20,156 Accounts Are Ready to Steal

HEROIC analysts uncovered a stealer log file titled "Outlook.com 22K" distributed through a Telegram channel in May 2026. The dataset exposes 20,156 compromised records, each containing an Outlook.com email address paired with its plaintext password and the URL where the credential was harvested. The affected accounts are primarily associated with users in the United States.

Why Plaintext Outlook Passwords Are a Gateway to Everything

The passwords in this leak are stored in plaintext, meaning they can be used immediately without any decryption. Outlook.com accounts are particularly high-value targets because they integrate with Microsoft's entire ecosystem, including OneDrive, Office 365, Teams, and Skype. A single compromised Outlook password can grant access to an entire suite of productivity tools and stored files.

Because many users rely on their Outlook address as the recovery email for other accounts, a compromised Outlook password does not just expose one inbox. It provides a pathway to reset passwords on banking sites, social media platforms, and cloud services linked to that email address.

What Was Exposed in the Outlook.com 22K Dump

• Email Addresses — Outlook.com accounts serving as both login and recovery identifiers
• Plaintext Passwords — Completely unencrypted, exploitable without any tools
• URLs — The exact websites and services where credentials were captured from browsers

Why 20,156 Exposed Credentials Represent a Serious Threat

With over 20,000 credential pairs available, attackers have a substantial dataset to weaponize through credential stuffing campaigns. Automated tools can cycle through every email-password combination against popular services like Amazon, PayPal, Netflix, and banking portals in a matter of hours.

The scale of this dump increases the likelihood that high-value accounts are included. Among 20,156 records, there are likely corporate email accounts, administrative credentials, and accounts tied to financial services. Each successful login gives attackers a foothold for further exploitation, from identity theft to business email compromise.

The bundled URLs add precision to these attacks. Instead of guessing where credentials might work, attackers can see exactly which services each victim used, allowing them to target the most valuable accounts first.

How Stealer Logs Strip Outlook Accounts of Their Security

This dataset originated from infostealer malware installed on victims' devices without their knowledge. These programs typically arrive as email attachments disguised as invoices, software activation tools, or game modifications. Once executed, they embed themselves in the operating system and begin extracting data.

The malware targets browser password stores with surgical precision, pulling saved credentials for email providers, e-commerce sites, and financial institutions. It also captures cookies and session tokens that can bypass two-factor authentication in some cases, making the stolen data even more dangerous than a simple username-password pair.

After extraction, the credentials are compiled into log files and transmitted to attacker-controlled servers. These logs are then sold in bulk on dark web marketplaces or shared freely on Telegram channels, where they spread rapidly across criminal networks.

Check If Your Outlook Credentials Were Exposed

If you use an Outlook.com email address for personal or professional purposes, your credentials could be part of this or similar stealer log distributions. HEROIC maintains a breach scanner that searches more than 400 billion compromised records to help you determine your exposure.

Use the HEROIC breach scanner to check whether your Outlook email appears in any known data leak. If it does, change your Microsoft account password immediately, enable multi-factor authentication through the Microsoft Authenticator app, and review your account's recent sign-in activity for any unauthorized access.