Webmail Users Exposed in the Piecehk 2 Hotmail Combolist Leak

Webmail Account Holders Exposed in the Piecehk 2 Hotmail Combolist

On June 9, 2025, HEROIC analysts identified a combolist labeled "HOTMAIL UHQ By Piecehk 2" circulating on Telegram. The file contains 761 records, each pairing a Hotmail or Outlook style webmail address with a plaintext password and the URL the login was used on.

Why This Is Dangerous

Webmail accounts sit at the center of a person's digital identity, handling password resets, two-factor codes, and account notifications for nearly every other service they use. Because the 761 passwords in this dump are stored in plaintext, an attacker who obtains the file can log into a victim's webmail account directly, with no cracking or guessing needed.

What Was Exposed in the Piecehk 2 Hotmail Leak

• Email addresses (Hotmail and Outlook style webmail accounts)
• Plaintext passwords (not hashed or encrypted)
• URLs tied to each set of credentials

Why This Matters for Webmail Users Specifically

Because webmail is the recovery point for so many other accounts, a compromised inbox can quickly turn into a chain reaction. If your address is among the 761 records here, an attacker with access to your inbox could reset passwords on your banking, shopping, or social media accounts, leading to credential stuffing, account takeover, identity theft, and financial fraud well beyond email itself.

How Webmail-Focused Combolists Like This Get Made

Uploaders who specialize in a single email provider, as with the "Piecehk" series of Hotmail dumps, typically filter larger stolen credential collections down to just the addresses from that provider, then verify each login before packaging and labeling it "UHQ" to signal quality to buyers.

Check If You Are Affected

If your primary email is a Hotmail or Outlook address, it is worth checking your exposure directly. HEROIC's free breach scanner searches more than 400 billion leaked records, including webmail-focused combolists like the Piecehk 2 Hotmail dump, so you can confirm your status and protect your inbox.