The Hotmail 2 Leak: 273 Passwords Exposed. Yours Might Be One.

HEROIC analysts identified a combolist labeled "Hotmail 2" circulating on a Telegram channel in May 2026. The file paired 273 email addresses with plaintext passwords and the URLs of the sites those logins belong to, the standard format attackers use to automate login attempts across the web.

The Hotmail 2 Combolist Is Small, But the Risk Is Not

Two hundred seventy-three records is a modest file, but every single one is a working email and password pair stored in plaintext. That means an attacker does not need to crack or guess anything, they simply copy a pair and try logging in. A small combolist like this often circulates precisely because it has already been checked and confirmed to still work, making it more immediately dangerous than its size suggests.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each credential pair to its original login page

Why This Matters

Because these are webmail credentials, a successful login gives an attacker the ability to read private messages and reset passwords on any other account tied to that inbox. Anyone whose email and password appear in this file faces a real risk of credential stuffing, where automated tools feed leaked logins into hundreds of websites at once looking for a match. If the password has ever been reused elsewhere, that account is exposed too.

How Combolists Like This One Are Built

Combolists are compiled by merging credentials pulled from older breaches, phishing kits, and malware logs into a single searchable file, then formatted as email:password or email:password:URL so they can be fed straight into automated login tools. They are traded and sold cheaply on Telegram and dark web forums because they let low-skill attackers run large-scale login attempts with almost no technical effort. A file's small size does not make it safe, every record in it is a real account.

Check If You Are Affected

You do not have to guess whether your information is sitting in a dump like this one. HEROIC's free breach scanner checks your email address against more than 400 billion leaked records pulled from combolists, stealer logs, and dark web marketplaces. Run a free scan, and if a match turns up, change that password everywhere else you have used it.