Someone Has Your Password: 336,384 Outlook Credentials Leaked

HEROIC's Dark Web monitoring systems detected a stealer log targeting Microsoft Outlook users labeled Outlook 04.09 on Telegram. The dump is substantial, containing 336,384 compromised records. Each entry consists of an Outlook email address, the user's plaintext password, and the URL where the credential was captured by infostealer malware. Given that Outlook accounts are central to the Microsoft ecosystem, this breach has far-reaching implications for every affected user.

336,384 Passwords With No Protection

Not a single password in this file is encrypted or hashed. All 336,384 credentials appear in plaintext — fully readable, fully usable. For Outlook users, this is especially alarming because Outlook passwords often grant access to the entire Microsoft account, including OneDrive files, Teams conversations, SharePoint documents, and linked third-party subscriptions. The moment an attacker finds your entry in this dump, they have everything they need to take over your digital workspace.

What Was Exposed

• Email Addresses — Outlook accounts connected to Microsoft's full suite of cloud services
• Plaintext Passwords — credentials exposed in their exact, original form with zero encryption
• URLs — login pages and services where each credential was intercepted by malware

Your Outlook Password Protects More Than Email

An Outlook account is not just an inbox. It connects to OneDrive, Microsoft 365, Teams, Xbox, Skype, and numerous third-party integrations. Attackers who gain access through credential stuffing can read private emails, access shared documents, impersonate you in workplace communications, and use your account to launch phishing attacks against your contacts. With 336,384 passwords exposed, the potential for cascading compromise across organizations and personal networks is enormous.

How Your Outlook Password Was Stolen

The Outlook 04.09 dump was produced by infostealer malware that infected victims' computers. These malware programs typically arrive through phishing emails disguised as legitimate Microsoft notifications, pirated Office installers, or malicious links in chat applications. Once active, the malware extracts every credential stored in the victim's browsers, including Outlook login details saved in Chrome, Edge, Firefox, and other browsers. The stolen data is compiled into organized log files and distributed through underground channels.

Check If Your Credentials Were Exposed

All 336,384 records from the Outlook 04.09 stealer log have been added to HEROIC's breach database, which contains over 400 billion compromised records. Use HEROIC's free breach scanner to check if your Outlook email or password appears in this leak. If you find a match, change your Microsoft account password immediately, enable multi-factor authentication, review recent sign-in activity, and revoke any unfamiliar app permissions connected to your account.