US Hotmail Users Hit: 4,484 Emails and Passwords Leaked

4.500 HOTMAIL Stealer Log: 4,484 US Records Exposed

On 18-Oct-2024, HEROIC analysts found a file named "4.500 HOTMAIL" uploaded by a Telegram user trading in stolen login data. The file contained 4,484 records tied to United States accounts, each pairing a Hotmail email address with a plaintext password and the URL of the site the login was captured on.

Why This Stealer Log Is Dangerous

This leak is dangerous because it targets Hotmail inboxes specifically, and email accounts are the gateway to almost everything else a person does online. Anyone with the password to one of these Hotmail accounts can use it to request password resets on banking, shopping, and social media accounts, effectively getting a second way in even if the victim never reused their password anywhere else. Because the passwords are stored in plaintext with the exact login URL attached, there is nothing slowing an attacker down.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites the credentials were used on

Why This Matters

For the US-based Hotmail users in this file, a compromised inbox can quickly cascade into credential stuffing attempts and account takeover across other services that rely on that same email address for password recovery. Anyone affected should assume the exposed password is compromised and treat their email account as the top priority to secure, since losing it can put every other online account at risk.

How Stealer Logs Work

Stealer logs are built by malware that infects a victim's device and silently collects saved browser logins, passwords, and the sites they belong to. That stolen data is packaged into a file, like this one focused on Hotmail accounts in the United States, and distributed through Telegram channels and dark web marketplaces where other criminals can access it.

Check If You Are Affected

Because a compromised email account can expose everything connected to it, checking your status now is worthwhile. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like this one, so you can quickly confirm your exposure and secure your inbox.