X535 Hotmail Combolist: 535 Emails and Passwords Leaked

HEROIC analysts found a combolist labeled "X535 HOTMAIL" circulating on Telegram, uploaded on 20 August 2026. The file contains 535 records pairing Hotmail email addresses with plaintext passwords and the URLs the credentials were used on, a small but usable batch built specifically around Hotmail accounts.

Why This Is Dangerous

Because the passwords are stored in plaintext, anyone who gets this file can log in immediately, with no password cracking involved. A Hotmail-focused list is especially useful to attackers because a single working email and password pair often unlocks a Microsoft account tied to Outlook, OneDrive, and other connected services.

What Was Exposed

• Hotmail email addresses
• Plaintext passwords
• URLs tied to the original login pages

Why This Matters

A working email and password pair rarely stays confined to one account. Attackers run these lists through credential stuffing tools that automatically try the same combination across banking sites, shopping accounts, and social media. If you reuse a Hotmail password elsewhere, one exposed pair can lead to account takeover, identity theft, or direct financial fraud.

How Combolists Work

A combolist is a simple text file of email and password pairs, usually gathered from older leaks, phishing kits, or malware and then sorted by email provider or region before being shared. Sorting by provider, as this one does with Hotmail, makes it faster for an attacker to target a specific type of account rather than sifting through mixed data.

Check If You Are Affected

Use HEROIC's free breach scanner to check whether your Hotmail address appears in this combolist or anywhere in HEROIC's database of more than 400 billion breached records. If it does, change that password right away and turn on two-factor authentication for your Microsoft account.