Small List, Real Exposure: The HOTMAIL HITS Combolist Has 100 Logins

In June 2026, HEROIC analysts identified a small combolist named "HOTMAIL HITS" uploaded to a Telegram channel. The file contains just 100 records, each pairing a Hotmail email address with a plaintext password and a linked URL. Why This Is Dangerous A hundred records is a small list, but the term "hits" in the file name indicates these are credentials that were tested and confirmed to still work at the time of upload. That makes every entry in this file more dangerous than an average unverified combolist of the same size, since an attacker knows the login is currently valid before they even try it. What Was Exposed in the HOTMAIL HITS File Email addresses (Hotmail) Plaintext passwords URLs linked to each login Why This Matters Because this list only contains confirmed working logins, an attacker doesn't need to run a large credential stuffing campaign to find success, they already know these accounts are accessible. That makes each of the 100 accounts in this file an immediate target for account takeover, with the attacker able to reset linked passwords, access personal emails, or use the account to reach the victim's contacts. How "Hits" Lists Like This Get Made A "hits" file is the output of a validity check run against a larger combolist or stealer log, where automated tools attempt to log in with each credential and only keep the ones that succeed. This filtering step is what separates a "hits" list from a raw combolist, and it's why files like "HOTMAIL HITS," even at just 100 records, are treated as higher value by the people trading them. Check If You Are Affected If you use a Hotmail account, it's worth checking whether your login shows up in a confirmed-working list like this one. HEROIC's free breach scanner searches more than 400 billion leaked records and tells you instantly if your email address has been exposed, so you can change your password before someone else uses it.