US Hotmail Users Targeted in 3,561-Record Combo List Leak

In November 2024, a file labeled as a Hotmail combo list surfaced on Telegram, uploaded by a user distributing stolen credentials in bulk. Inside were 3,561 sets of Hotmail email addresses paired with plaintext passwords and the URLs they logged into. Combo lists like this one exist for a single purpose: giving attackers a ready-made list of specific targets to attack at scale.

Who Ends Up in a File Like This

Combo lists are built by filtering stealer log data down to one specific email provider, in this case Hotmail, so that buyers can focus their attacks on a predictable pool of accounts. Anyone with a Hotmail or Outlook address is a potential target here, regardless of where they live or what they use the account for. The file does not care who you are, only that your address ends in the right domain and your password was sitting unprotected on an infected device.

What Was Exposed

• Hotmail email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

Because combo lists are organized and ready to use, they move faster into attacks than raw stealer logs do. Criminals load lists like this one directly into credential stuffing tools that test each email and password pair against banking sites, shopping platforms, and social media in minutes. Reused passwords turn a single Hotmail leak into account takeover, identity theft, and financial fraud on services that have nothing to do with Hotmail itself.

How Hotmail Combo Lists Get Made

Combo lists start life as raw stealer log dumps pulled from malware-infected computers. Sellers and Telegram distributors then sort those dumps by email domain, stripping out everything except Hotmail addresses to create a focused, easy-to-sell product. The result is a clean, ready-to-use target list, exactly like the 3,561-record file behind this report, that gets resold and reused long after the original infection took place.

Check If You Are Affected

If you use a Hotmail or Outlook address, it is worth knowing whether you were part of this combo list. HEROIC's free breach scanner checks your email against more than 400 billion leaked and breached records and tells you immediately if your credentials were exposed. Run a free scan now and change any passwords that show up as compromised.