Spanish Hotmail Users Hit: 195 Passwords Exposed in Leak

HEROIC analysts discovered a stealer log file targeting hotmail.es users that was shared on Telegram in June 2026. The file contains 195 records harvested by infostealer malware, each including an email address, a plaintext password, and the URL where the credential was captured. The hotmail.es domain serves Spanish-speaking users of Microsoft's legacy Hotmail platform, and this leak specifically impacts individuals who rely on these accounts for daily communication.

With 195 plaintext credentials now publicly available, every affected user faces the risk of immediate account takeover. The Spanish-language focus of this dump may also indicate a targeted malware campaign aimed at users in Spain and Latin America.

Why Plaintext Passwords Create an Instant Attack Window

The hotmail.es stealer log contains passwords in their raw, unprotected form. No encryption, no hashing, no salting — just readable text that any attacker can use immediately. This stands in sharp contrast to database breaches where stolen password hashes must first be cracked, giving defenders valuable time to respond.

With plaintext credentials, there is no buffer period. From the moment this file appeared on Telegram, every password in it became a live weapon. Attackers can feed these credentials into automated tools that test them across email providers, banking portals, streaming services, and social networks within minutes of downloading the file.

What Was Exposed in the hotmail.es Dump

• Email Addresses — Spanish Hotmail accounts used for personal communication, account recovery, and service registration, making them high-priority targets for attackers.
• Plaintext Passwords — Completely unencrypted credentials stolen directly from victims' devices, usable without any processing or decryption effort.
• URLs — The login pages and web services where each credential was intercepted, providing a map of the victim's online activity and confirming which accounts are vulnerable.

Why 195 Stolen Email Credentials Escalate Quickly

Email accounts occupy a unique position in digital security because they serve as the recovery mechanism for virtually every other online account. When an attacker controls a victim's hotmail.es inbox, they can reset passwords on banking sites, social media platforms, cloud storage services, and government portals — all without needing any additional credentials.

Compounding this risk is the prevalence of password reuse. With over 60% of users sharing passwords across accounts, each of the 195 stolen credential pairs is likely to work on multiple services beyond Hotmail. The actual number of accounts exposed by this leak is almost certainly several times larger than the 195 records in the original file.

How Stealer Logs Target Specific User Populations

The hotmail.es stealer log was not a random collection of data. Infostealer malware captures credentials from every service a victim uses, but attackers often sort and filter the results by email domain before distribution. This filtering process created a targeted file of Spanish Hotmail users — a curated dataset that other threat actors can use for focused campaigns against Spanish-language services.

The underlying infection process is the same across all stealer logs: malware silently installs on a victim's device, monitors browser activity, and extracts credentials from login forms and saved password stores. The data is then organized, packaged, and uploaded to Telegram channels where it reaches a global audience of threat actors within hours.

Check If Your Credentials Appear in This Leak

If you use a hotmail.es email address or any Microsoft-linked account, HEROIC's free breach scanner can determine whether your credentials were included in this dump. The tool searches more than 400 billion compromised records across thousands of known breaches, providing comprehensive visibility into your exposure.

Should your information appear, change your hotmail.es password immediately and update every account that shares the same login credentials. Activate two-factor authentication on your email and all critical services, and scan your devices for malware to ensure no infostealer continues to operate in the background.