Search Your Email: The UHQ Hotmails Combo Exposed 1,136 Accounts

In June 2026, HEROIC analysts found a combolist labeled "1140x UHQ Hotmails" uploaded to a Telegram channel by an unnamed user. The file contained 1,136 records, each pairing an email address with a plaintext password and the URL of the login page it unlocks. The "UHQ," or ultra high quality, label suggests this batch was marketed to buyers as a verified or higher-value collection of Hotmail account logins. Why This Is Dangerous: Every one of these 1,136 passwords is stored in plain text, so anyone who opens the file can read and use the credentials right away. Because each entry includes the specific login URL, an attacker does not need to figure out where a stolen password might work. The file provides that information directly. What Was Exposed: - Email addresses - Plaintext passwords - URLs for the associated login pages Why This Matters: If any of these 1,136 Hotmail users reused their password on other accounts, attackers can use this file to attempt logins across banking, shopping, or social media sites, a method known as credential stuffing. Gaining access to an email account is often just the first step, since it can then be used to reset passwords on other linked accounts. How Combolists Work: Combolists are compiled files of email or username and password pairs, gathered from a mix of older breaches, stealer logs, and previous leaks, then bundled into a single list. Sellers often label these files as "UHQ" or similarly branded to suggest higher quality or verified accounts, then distribute or sell them through Telegram channels and dark web marketplaces. Check If You Are Affected: If you use a Hotmail account, it is worth checking whether your credentials appear among these 1,136 records. HEROIC's free breach scanner searches a database of more than 400 billion breached records, including combolists like this one, so you can search your email and find out in seconds.