What Is a Combo List? 31,492 Hotmail Logins Leaked Online

36k Hotmail Combo Stealer Log: 31,492 Records Exposed

On 08-Nov-2024, HEROIC analysts identified a file named "36k HOTMAIL COMBO HQHOTMAILCOMBOOWNER" uploaded by a Telegram user in a channel used to trade stolen login data. Despite the "36k" in the file name, HEROIC cataloged 31,492 records, each pairing a Hotmail email address with a plaintext password and the URL of the site the login was captured on. This is a good example of what security researchers call a "combo list."

Why This Combo List Is Dangerous

A combo list like this one is dangerous because it packages working logins into a ready-to-use format, sorted by email provider, with the exact site each password belongs to already attached. There is no cracking, guessing, or extra work required: an attacker can open the file and start logging into Hotmail inboxes immediately. Because the passwords are stored in plaintext, that access is instant.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites the credentials were used on

Why This Matters

Because this combo list targets Hotmail accounts, anyone affected faces risk that goes beyond their inbox, since email access can be used to reset passwords on banking, shopping, and social media accounts tied to that address. Combo lists like this are also frequently reused for credential stuffing, where automated tools test the same login pairs across many other sites hoping people reused their password elsewhere.

How Combo Lists Work

A combo list is simply a large file of stolen email and password pairs, often sorted by the site or email provider they belong to, which is exactly why this one is labeled "HOTMAIL." The credentials inside typically come from malware called a stealer, which infects a device and copies saved browser logins before the data is compiled into a combo file and traded through Telegram channels and dark web marketplaces.

Check If You Are Affected

Since combo lists are built specifically for attackers to use quickly, checking your exposure now is the safer choice. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including combo lists like this one, so you can confirm whether you were affected and update any exposed passwords.