How a Telegram Combolist Exposed 1,090 SOLOADMIN HOTMAIL Logins

HEROIC analysts identified a combolist file named “SOLOADMIN HOTMAIL” that was uploaded to a Telegram channel on 15 August 2026. It contains 1,090 records, each pairing an email address with a plaintext password and the URL of the login page the credential was used on.

Why This Is Dangerous

The passwords in this file are stored as plain, readable text, not hashed or encrypted. Anyone who obtains the SOLOADMIN HOTMAIL file can read every credential immediately and start testing it against other accounts without needing to crack anything.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs identifying the site or service each login was used on

Why This Matters

A leak of 1,090 accounts is still enough to fuel credential stuffing, the practice of testing leaked email and password pairs against banks, email providers, and social platforms in bulk. Because so many people reuse the same password across multiple accounts, anyone in this leak who did so faces a real risk of account takeover, identity theft, and financial fraud tied to services well beyond the original login.

How This SOLOADMIN HOTMAIL Combolist Came Together

The file’s name suggests it was built specifically around Hotmail and Outlook style email accounts, a common practice for people who compile combolists targeting one email provider so buyers can filter for a specific type of account. Regardless of the naming, the underlying process is the same: a Telegram user gathered email and password pairs from various sources and uploaded the finished list for others to use or trade.

Check If You Are Affected

If you use a Hotmail or Outlook address, it is worth checking now. HEROIC's free breach scanner searches your email against more than 400 billion breached records, including this leak, so you can see in seconds whether your credentials were exposed and change any passwords you have reused.