As many as 10,000 passwords from Microsoft's free email service Hotmail have been posted online, reports Neowin.net. The online publication said that the accounts start with the letters A through B, with the report noting that it may be part of an online phishing scheme.

Email addresses that use @hotmail.com, @msn.com and @live.com may be affected. [Post updated with Microsoft's comments]

Microsoft is aware of the situation is investigating the matter, according to the BBC, which has confirmed that the accounts posted online at pastebin.com are genuine. The accounts have since been taking down, though many news publications are encouraging Hotmail users to change their passwords.

Notes The Register:

The appropriation of a web-based email account can often lead to much bigger compromises because many people tie online accounts for banks and e-commerce sites to their addresses. Those who have any doubt about the security of their Windows Live addresses ought to change their passwords immediately out of an abundance of caution.

UPDATE: Here's Microsoft's statement on the situation:

Over the weekend Microsoft learned that several thousand Windows Live Hotmail customers’ credentials were exposed on a third-party site due to a phishing scheme. As always, upon learning of the issue, we immediately requested that the credentials be removed and launched an investigation to determine the impact to customers.

As part of that investigation, we determined that this was not a breach of internal Microsoft data and initiated our standard process of working to help customers regain control of their accounts. Phishing is an industry-wide problem and Microsoft is committed to helping consumers have a safe, secure and positive online experience.

Our guidance to customers is to exercise extreme caution when opening unsolicited attachments and links from both known and unknown sources, and that they install and regularly update their anti-virus software.” Microsoft recommends customers use the following protective security measures:

--Renew their passwords for LIVE-IDs every 90 days

--For administrators, make sure you approve and authenticate only users that you know and can verify credentials

--As phishing sites can also pose additional threats, Install and keep anti-virus software up to date.