U.S. Hotmail Users Targeted: 791 Passwords Exposed

In October 2024, HEROIC detected a stealer log file labeled "Hotmails" being shared on Telegram. While smaller in scale at 791 records, this targeted dump focuses exclusively on Hotmail account credentials stored in plaintext, making every affected user vulnerable to instant account compromise.

Even Small Leaks With Plaintext Passwords Are Dangerous

Size does not determine severity when passwords are in plaintext. Each of the 791 credentials in this dump can be used immediately—no cracking, no decryption, no technical skill required. A threat actor simply needs to open the file and start logging into accounts. For Hotmail users whose credentials appear here, the breach is already actionable from the moment it was shared.

What Was Exposed

• Email Addresses — Hotmail accounts belonging primarily to U.S.-based users
• Plaintext Passwords — unprotected login credentials in readable text
• URLs — websites and services where each credential was harvested by malware

Your Hotmail Password Is a Gateway to Other Accounts

A compromised Hotmail account is more than just an email breach. Attackers use credential stuffing to test each email-password pair across other services—banks, online retailers, streaming platforms, and workplace tools. If you use the same password for Hotmail and any other account, every one of those accounts is now at risk. Additionally, access to your email lets attackers reset passwords on other services, creating a cascading compromise that extends far beyond the original breach.

Stealer Malware: The Source of These Credentials

This data was captured by infostealer malware—software designed to silently extract saved credentials from web browsers on infected devices. Users typically encounter this malware through deceptive email attachments, fake download links, or compromised websites. The malware runs invisibly in the background, harvesting login data from every site the victim has saved credentials for, then packaging it all into log files that are sold or freely distributed on platforms like Telegram.

Check If Your Credentials Were Exposed

Even a dump of 791 records can include your account. Search your email address using HEROIC's breach scanner, which covers more than 400 billion compromised records from data breaches and stealer log collections worldwide. In seconds, you can find out if your Hotmail credentials were exposed in this leak or any other, and take immediate steps to change your password and enable multi-factor authentication.