1,176 Hotmail Logins Leaked: Is Yours in the X1438 HQ File?

Could your Hotmail login be sitting in a Telegram combolist right now? HEROIC analysts logged X1438 HQ H0TMAIL on 23 August 2026, a file of 1,176 Hotmail-style email addresses paired with plaintext passwords and the login URLs each one was collected from.

Why a Hotmail-Focused List Is Worth Extra Attention

Files like X1438 HQ H0TMAIL are narrowed to one email provider on purpose, which makes them easier for an attacker to run efficiently against Microsoft's login systems and any service that lets you sign in with the same address. That focus is what makes this smaller file just as usable as a larger, mixed one.

What Was Exposed

• Email addresses: 1,176 Hotmail and Outlook-style addresses collected for this file.
• Plaintext passwords: readable immediately, with no cracking required.
• URLs: the login pages tied to each credential pair.

Why This Matters Beyond the Inbox

A compromised Hotmail account is often the key to everything else, since it is where password reset links land. If any of these 1,176 credentials still work, an attacker can use the inbox itself to reset passwords on other accounts tied to that same email address.

How a Combolist Like X1438 HQ Gets Built

X1438 HQ H0TMAIL is a combolist, compiled by gathering email and password pairs from earlier leaks and stealer logs rather than pulled from a break-in at Microsoft's own systems. Grouping by provider is simply how these lists get organized for resale or sharing.

Is Your Hotmail Address in the X1438 HQ File?

Scan your email to check it against this file and HEROIC's wider records. If it appears, change that Hotmail password immediately and update it anywhere else you have reused it, starting with your email and any linked financial accounts. The same check is worth running for a work email address too, not just a personal Hotmail account.