The HOTMAIL TEST Leak Could Give Hackers Access to Your Email and Bank

HEROIC analysts identified this stealer log on 18-May-2026. The breach exposed 2,099 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as HOTMAIL TEST.

Why This Is Dangerous

The HOTMAIL TEST file contains 2,099 Hotmail email and password pairs that were distributed through Telegram. Files labeled with "TEST" in dark web contexts often indicate that the credentials were verified against the live login system before sharing, meaning all 2,099 entries were confirmed to work at the time of distribution. This reduces the effort criminals need to find active accounts to attack.

What Was Exposed

• Email addresses (Hotmail accounts)
• Plaintext passwords
• URLs (websites where credentials were used)

Why This Matters

Hotmail is used to access banking services, social media, and work accounts through single sign-on and password reset flows. When a criminal gains access to a Hotmail inbox, they can take over every account linked to that email address. Social media accounts can be used for scams, banking accounts can be drained, and personal information can be sold or used for identity fraud.

How a Stealer Log Works

Stealer malware is commonly spread through phishing emails that appear to come from legitimate services. When a victim clicks a malicious link or attachment, the malware installs silently and begins collecting login credentials from the browser and from active sessions. Email-focused stealer logs like this one are the result of malware specifically configured to prioritize inbox access.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to see if your credentials appear here or elsewhere. Free, takes seconds.