Other addresses include Comcast and Earthlink accounts.
It is not clear whether the new list was part of the same phishing attack that collected the Hotmail addresses or a separate scam.
"Our guidance to customers is to exercise extreme caution when opening unsolicited attachments and links from both known and unknown sources, and that they install and regularly update their anti-virus software."
security expert Graham Cluley of Sophos advised users to change their passwords as soon as possible.

"I'd also recommend that people change the password on any other site where they use it," he said.
About 40% of people had the same password for every website they used, he added.