X2004 HQ Hotmail Combolist: 2,002 Accounts at Risk of Takeover

X2004 HQ Hotmail Combolist Puts 2,002 Accounts at Risk

HEROIC analysts identified a combolist titled "X2004 HQ H0TMAIL," uploaded by a Telegram user on 1 July 2026. The file contains 2,002 records, each pairing a Hotmail email address with a plaintext password and the URL the credentials were used on.

Why This Is Dangerous

Labeling a combolist "HQ," short for high quality, is a signal to buyers that the credentials inside are verified and working. Because the passwords are stored in plaintext, anyone who obtains this file can log into any of the 2,002 Hotmail accounts immediately, without needing to crack or decode anything.

What Was Exposed

• Email addresses (Hotmail accounts)
• Plaintext passwords
• URLs

Why This Matters

Hotmail accounts are frequently used to recover access to banking apps, online shopping accounts, and social media profiles. If any of these 2,002 people reused their Hotmail password on another site, attackers can use this list to attempt credential stuffing across dozens of other services, turning one leaked password into multiple compromised accounts and, potentially, financial fraud.

How an "HQ" Combolist Like This Gets Made

Combolists such as this one are usually built by pulling credentials from stealer logs, older breaches, or smaller leaks, then testing each pair against the login page listed in the URL to confirm it still works. Only the pairs that successfully log in are kept, which is what earns the file its "HQ" label before it's uploaded to Telegram channels and traded among other cybercriminals.

Check If You Are Affected

If you have a Hotmail or Outlook account, or reuse the same password on multiple sites, checking your exposure takes only a minute. HEROIC's free breach scanner compares your email against a database of more than 400 billion leaked records, so you can find out if you're part of this leak and change any exposed passwords right away.