Dark Web Intel: X2212 HQ H0TMAIL Dump Exposes 2,212 Hotmail Logins

Dark Web Intel: X2212 HQ H0TMAIL Dump Contains 2,212 Hotmail Logins

HEROIC's threat intelligence team tracked down a combolist called "X2212 HQ H0TMAIL" that surfaced on Telegram on 16 August 2026. The file contains 2,212 records, each pairing a Hotmail or Outlook email address with a plaintext password and the URL the credentials were captured from. As the name suggests, this list was specifically curated to isolate Microsoft webmail accounts, a niche that carries outsized value on underground marketplaces.

Why This Is Dangerous

Webmail accounts like Hotmail and Outlook usually double as the recovery address for dozens of other logins, from online banking to shopping and social media. A criminal who gets into one of these inboxes doesn't just read someone's email, they gain the ability to trigger "forgot password" resets across a person's entire digital footprint. And because the passwords in this file are stored in plaintext, there's no technical barrier standing between the data and misuse.

What Was Exposed

• Hotmail and Outlook email addresses
• Plaintext passwords
• URLs associated with each login

Why This Matters

Once a Hotmail credential is in circulation, it can be used for far more than reading old messages. Attackers commonly try leaked passwords across other popular platforms in bulk, a method known as credential stuffing, and a single successful match can lead to account takeover, unauthorized purchases, or a stolen identity used to open new accounts elsewhere. The narrow focus on one email provider makes this list especially efficient for that kind of automated attack.

How Provider-Specific Combolists End Up on Telegram

Lists like this one are typically stitched together from older breaches, phishing kits, and stealer malware logs, then filtered down to a single email domain before being posted or sold. Splitting large mixed dumps into smaller, provider-specific files makes them easier to move on Telegram channels, where buyers often want a targeted set of accounts rather than a random assortment. The "HQ" tag signals the seller believes the credentials have been verified as still active.

Check If You Are Affected

If you have a Hotmail or Outlook address, now is a good time to check whether it appears in this dump or any other breach on record. HEROIC's free dark web scanner searches a database of more than 400 billion compromised records and tells you right away if your information has been exposed. Run a free scan and reset any password that shows up before it's used against you.