Riot Games Accounts Hit in Hotmail Combolist Breach

HEROIC analysts identified a targeted combolist called hotmail 2 2_hits_noreplyumail.accounts.riotgames.com, uploaded to a Telegram channel on 13-Dec-2024. It contains 9 confirmed records, each pairing a Hotmail email address with a plaintext password tied to Riot Games account notifications.

Why This Is Dangerous

These 9 records are not guesses, they are verified logins tied specifically to Riot Games account holders. Anyone with this file can access the linked Hotmail inbox directly, and from there attempt to hijack the associated Riot Games account, including any linked payment methods or in-game purchases.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to Riot Games account notifications

Why This Matters

Gaming accounts are a favorite target for credential stuffing because they often hold stored payment methods and valuable in-game items. A compromised Hotmail login tied to Riot Games can lead directly to account takeover, unauthorized purchases, and broader identity theft if the same password was reused on other services.

How Combolist Breaches Work

This list was built by testing a batch of previously stolen credentials specifically against Riot Games' account notification system, keeping only the pairs that returned a successful login. The result, these 9 confirmed hits, is exactly the kind of targeted, ready to use list criminals seek out and trade on Telegram.

Check If You Are Affected

If you have a Riot Games account tied to a Hotmail address, it is worth confirming your exposure directly. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, so you can find out quickly whether your login is part of this leak and secure it before anyone touches your account.