The UHQ Hotmail Combo Leaked in 2024. The Data Is Still Circulating.

HEROIC analysts identified a combolist named UHQ Hotmail Combo Test hqhotmailcomboowner that was originally dated November 2, 2024, but continues to circulate on Telegram. The file contains 11,550 records of email addresses paired with plaintext passwords and associated URLs. Why This Is Dangerous: The fact that this file is roughly two years old doesn't make it safe. Many people never change passwords after a leak they don't know about, which means credentials from 2024 can still unlock accounts in 2026. With all 11,550 passwords stored in plaintext, there's nothing stopping anyone who downloads this file from trying them today. What Was Exposed: The UHQ Hotmail Combo Test file contains three fields for each of its 11,550 records. - Email addresses - Plaintext passwords - URLs tied to the accounts Why This Matters: An old, unresolved leak is often more dangerous than a fresh one, because the initial news cycle has passed and people have stopped paying attention. Attackers know this and specifically dig up older combolists to run through credential stuffing tools, betting that a meaningful share of passwords were never changed, which can lead directly to account takeover, identity theft, or financial fraud. How a Combolist Like This Works: Combolists are text files pairing usernames or emails with passwords, often labeled "test" or "combo" by the uploader to describe how the file was compiled, in this case built specifically around Hotmail accounts. These files get re-uploaded and re-shared across Telegram channels long after their original creation date, which is exactly what appears to have happened here. Check If You Are Affected: A two-year-old leak is still worth checking today. HEROIC's free breach scanner searches your email against more than 400 billion breached records. If you're listed and haven't changed that password since 2024, do it now.