U.S. Hotmail Users Hit: Part2 19 Exposes 2,539,169 Passwords

HEROIC identified a massive stealer log collection called Hotmail Part2 19, uploaded to Telegram in January 2023, containing an extraordinary 2,539,169 compromised credential records. This is one of the largest Hotmail-targeted dumps HEROIC has cataloged, with credentials primarily harvested from U.S.-based devices infected with infostealer malware.

Over 2.5 Million Plaintext Passwords Now in the Open

The scale of this breach is staggering, and every single password is stored in plaintext. There is no encryption protecting any of these 2,539,169 credentials. Each one can be read, copied, and used to log into an account instantly. At this volume, automated exploitation tools can test millions of login attempts across services in a matter of hours.

What Was Exposed

• Email Addresses — over 2.5 million Hotmail and Microsoft-linked accounts exposed as login identifiers
• Plaintext Passwords — millions of unencrypted passwords ready for immediate exploitation
• URLs — the specific websites and services where each credential was captured during use

Credential Stuffing at Massive Scale

With over 2.5 million credential pairs, attackers can run industrial-scale credential stuffing campaigns. Automated tools cycle through every entry, testing each email-and-password combination against banking platforms, social media, e-commerce sites, and corporate login portals. The sheer volume guarantees a high number of successful matches, especially given how frequently people reuse passwords across services.

The Infostealer Pipeline Behind the Data

Stealer logs of this magnitude are typically compiled from multiple infostealer malware campaigns running simultaneously across thousands of infected devices. The malware — distributed through fake software downloads, malvertising, and phishing attacks — extracts saved passwords from browsers, records keystrokes during login sessions, and steals authentication tokens. The resulting log files are aggregated into massive collections like Hotmail Part2 19 and distributed through Telegram channels for widespread use.

Check If Your Credentials Were Exposed

All 2,539,169 records from Hotmail Part2 19 are now searchable in the HEROIC data breach scanner. With over 400 billion records across thousands of breaches, HEROIC offers instant verification of whether your email or password has been compromised. Given the enormous size of this leak, checking your exposure is critical. Search now, update affected passwords immediately, and activate two-factor authentication on all accounts.