Identity Theft Just Got Easier Because of the Test Hotmail Leak

HEROIC Analysts Uncover the Test Hotmail Stealer Log

On December 19, 2024, HEROIC's threat intelligence team identified a stealer log labeled "Test Hotmail" uploaded to Telegram by an anonymous user. The file contained 1,043 records, each pairing a Hotmail-linked email address with a plaintext password and the URL of the site the credentials were used on.

Identity Theft Just Got Easier Because of the Test Hotmail Leak

Despite the casual name, there's nothing test-scale about 1,043 real people's working email credentials sitting in a criminal's hands. A Hotmail login is often the account used to verify identity, receive password reset links, and store years of personal correspondence, tax documents, and account confirmations. Once an attacker has that inbox, piecing together enough personal details to commit identity theft becomes far easier than starting from nothing.

What Was Exposed in the Test Hotmail Log

• Hotmail and related email addresses used as account logins
• Plaintext passwords tied to those accounts
• The website URLs the credentials were used to access

Why This Matters for the 1,043 People Affected

Beyond direct account takeover, a compromised inbox lets an attacker search for bank statements, shopping receipts, and other sensitive messages, information that fuels identity theft and financial fraud far beyond the original login itself. If any of the 1,043 people affected reused this password elsewhere, the risk multiplies across every account tied to it.

How the Test Hotmail Log Was Harvested

This data comes from infostealer malware, which infects a device through phishing links, cracked software, or malicious downloads, then quietly reads saved browser passwords and autofill data. The stolen credentials are exported into a file and shared on Telegram, often labeled loosely or informally, like "Test," even when the data inside is fully real and usable.

Check If You Are Affected

Don't let a casual file name fool you into thinking your data is safe. HEROIC's free breach scanner checks your email against a database of more than 400 billion compromised records, so you can quickly find out if your credentials appear in this or another stealer log and change your password before it's used against you.