::Trend Micro Threat Resource Center::

06 October 2009

10,000 Hotmail Account Passwords Published Online

People with Hotmail accounts - and particularly people with Hotmail accounts beginning with the letter "a" or "b" - should change their passwords as soon as possible. A list containing about 10,000 account names and passwords has been published online.

Apparently the information was posted on pastebin.com on the first of this month. Tom Warren reports that the original post was deleted at some point, but people still managed to view it and spread the data around. So now an unknown number of hackers, scammers, and other bad guys may have the ability to access certain accounts.

What's more, even though the published list only covered email accounts starting with "a" and "b," the fact that everything was in alphabetical order implies that other lists exist. Or the existence of a complete set seems no less likely than the proven existence an incomplete one, at any rate.

So again, change your password if you use Hotmail and haven't done so already. Pick a different security question (and answer), too, while you're at it, and maybe check your outbox for suspicious messages in case your account's been abused.

Microsoft's promised in a statement that it's investigating the problem, so hopefully the source of the account info leak will be identified and plugged, at least.