‘Private Hotmail UHQ’ Leak Raises Identity Theft Risk for 999 Users

HEROIC analysts identified a combolist labeled "Private Hotmail UHQ by PieceHK 5" uploaded to a Telegram channel on June 20, 2025. The file contains 999 records of Hotmail email addresses paired with plaintext passwords and the URLs where those logins were used, marketed as a verified, high quality batch.

Why This Leak Makes Identity Theft Easier

Because these credentials are labeled "UHQ," for ultra high quality, they have likely been checked and confirmed to still work. A confirmed working email and password gives an attacker a direct way into someone's inbox, and from there, access to password reset emails, personal details, and account history that make identity theft far easier to pull off than starting from scratch.

What Was Exposed in This Hotmail Combolist

• Hotmail email addresses
• Plaintext passwords
• URLs linked to the accounts

Why This Matters for These 999 Accounts

An inbox is often the key to everything else. If an attacker logs into one of these 999 Hotmail accounts, they can search old emails for account numbers, use the address to reset passwords on banking or shopping sites, and impersonate the account owner. That chain of access is how a single leaked credential turns into identity theft or financial fraud.

How a Verified Hotmail Combolist Gets Made

A combolist like this one is built from email-and-password pairs gathered from older breaches, phishing pages, or malware infections, then filtered down to one provider, in this case Hotmail, and checked to confirm the logins still work before being labeled "UHQ" and sold or shared privately on Telegram.

Check If Your Hotmail Account Was Exposed

Because these credentials were verified as working, checking your exposure matters more than with an average leak. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including combolists like this one, so you can find out quickly and change any reused passwords before someone else does.