The Abv.bg Combolist Put 14,383 Stolen Email and Password Pairs Online

HEROIC analysts found a combolist labeled "14k abv.bg hits" that a Telegram user uploaded on May 10, 2023. The file contains 14,383 records, each combining an abv.bg email address, a plaintext password, and the URL the credentials belong to. Why this is dangerous: abv.bg is one of Bulgaria's most widely used email services, and because every password in this file is stored in plaintext, an attacker can use the credentials the moment they open the file. There is no cracking or guessing involved, just a direct login attempt using the data exactly as it was uploaded. What was exposed: the dataset lists abv.bg email addresses, plaintext passwords tied to each one, and the specific URLs the credentials unlock, giving an attacker a complete, ready-to-use login for all 14,383 accounts. Why this matters: many people reuse the same password across their email, banking, and social media accounts, so a single exposed abv.bg login can open far more doors than the original account. Attackers use combolists like this one to run credential stuffing, automatically testing each email and password pair against other popular websites until something works, which can quickly lead to account takeover, identity theft, or financial fraud. How this combolist was built: a combolist like this one is typically assembled from older breaches, stealer malware logs, or phishing campaigns, then sorted by email domain so buyers can target users of a specific provider, in this case abv.bg. Files like this are often traded on Telegram in bulk before they attract wider attention from security researchers or the public. Check if you are affected: if you use an abv.bg email address, or reuse the same password anywhere else, it is worth checking whether your credentials appear in this leak. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, giving you an instant answer so you can update any exposed passwords before someone else uses them.