Xbox Account Emails Leaked in Hotmail Combolist Breach

HEROIC analysts identified a combolist named hotmail 2 2_hits_Xboxengage.xbox.com, uploaded to Telegram on 13-Dec-2024. The file contains 39 confirmed records, each pairing a Hotmail email address with a plaintext password tied to Xbox account engagement emails.

Why This Is Dangerous

All 39 of these credential pairs were already verified as working logins before the file was shared, meaning an attacker gets guaranteed access with zero guesswork. Every entry represents a real Hotmail inbox linked to an active Xbox account, ready to be taken over.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to Xbox account engagement emails

Why This Matters

Xbox accounts frequently carry stored payment methods, subscription billing, and purchased game libraries, making them attractive credential stuffing targets. Once an attacker gets into the linked Hotmail inbox, they can move into the Xbox account itself, leading to account takeover, unauthorized charges, and identity theft if the password was reused elsewhere.

How Combolist Breaches Work

This list was created by testing a batch of previously stolen email and password combinations against Xbox's account engagement email system, keeping only the pairs that returned a valid login. The 39 confirmed hits left over form a targeted, ready to use combolist that gets shared and traded on Telegram.

Check If You Are Affected

If you use Hotmail with your Xbox account, checking whether you are one of these 39 exposed users takes only a moment. HEROIC's free breach scanner searches more than 400 billion leaked records, so you can confirm your exposure and update your password before someone else logs in first.