Your Data May Be Exposed: Hotmail Test Combolist Leaked 142 Records

In January 2025, a Telegram user uploaded a small combolist labeled "Hotmail test," containing 142 records that pair email addresses with plaintext passwords and associated URLs. HEROIC analysts flagged the file as part of routine monitoring of Telegram channels where stolen credentials are traded.

Why the Hotmail Test Leak Is Dangerous

Small does not mean safe. Each of the 142 records includes a working email and plaintext password pair, exactly what an attacker needs to log directly into an account or try the same password elsewhere. A list this size can still be tested against thousands of websites in minutes using automated tools.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

Attackers do not need a massive breach to cause damage. A short list like this can be used for targeted credential stuffing, where each of the 142 credentials is tried against email providers, banks, and social platforms. If a password here matches one you still use, your account could be compromised without any additional effort from the attacker.

How This Combolist Was Built

A combolist is a simple text file pairing usernames or emails with passwords, usually compiled from older leaks or malware logs and repackaged for distribution. Small combolists like "Hotmail test" are often test batches or samples that criminals share to prove a larger dataset is legitimate before selling the full file.

Check If You Are Affected

Even a 142-record leak is worth checking against your own accounts. HEROIC's free breach scanner searches more than 400 billion leaked records, including combolists like this one, so you can quickly see whether your email address has turned up anywhere in a breach and take action before someone else does.