Search Your Email: The Ninho Private Hotmail Dump Exposed 520 Accounts

In June 2026, HEROIC analysts identified a combolist named Ninho Private Hotmail circulating on Telegram, containing 520 records of email addresses and plaintext passwords tied to Hotmail accounts, along with the URLs associated with each entry.

Why This Is Dangerous

Being labeled "Private" suggests this list was not widely distributed before surfacing, meaning the credentials inside may still be unchanged and active. With 520 plaintext passwords already confirmed as Hotmail logins, an attacker has a direct, ready-to-use path into each account.

What Was Exposed in the Ninho Private Hotmail Leak

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

Hotmail accounts are frequently used to receive password reset links for other services, so gaining access to one can let an attacker pivot into banking, shopping, or social media accounts belonging to the same person. Even a list of 520 accounts is enough for a motivated attacker to cause real harm through account takeover and identity theft.

How a Combolist Like This Works

A "private" combolist like this one is typically kept within a smaller, closed group of buyers and sellers before it eventually leaks more broadly, as appears to have happened here. These lists are usually built the same way as public ones, by pulling credentials from breaches or malware logs and filtering them down to a single email provider, but they are marketed as more exclusive and less likely to have already been used by other criminals.

Check If You Are Affected

If you use a Hotmail address, it is worth checking your exposure now while the data is fresh. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to tell you if your credentials have surfaced.