Your Inbox May Be at Risk: The ABV.BG Combolist Leaked 500 Accounts

In January 2023, HEROIC analysts identified a combolist uploaded to Telegram containing 500 records tied to ABV.BG, a widely used Bulgarian webmail provider. The file paired email addresses with plaintext passwords and the URLs where each credential pair was originally used. Why is this dangerous? Because the passwords are stored in plaintext, anyone who obtains this file can read the credentials instantly, without any technical skill. Paired with the account's email address and the site it was used on, an attacker has a ready-made list of accounts to try logging into immediately. A file this size may be small, but for the 500 people in it, the risk is just as real as in a larger breach. What was exposed: email addresses from ABV.BG accounts, plaintext passwords, and the URLs linked to each credential pair. Why this matters: small combolists like this one are frequently combined with other leaked files to build larger attack lists. Criminals use them for credential stuffing, testing the same email and password combination against banking, shopping, and social media sites in hopes the victim reused it somewhere else. How this combolist was built: a combolist is a plain text file pairing usernames or email addresses with passwords, typically gathered from past breaches, phishing pages, or malware infections and then repackaged for sharing. Telegram channels have become a common place for this kind of file to circulate since uploads are fast and largely untraceable. Check if you are affected: rather than wonder whether your ABV.BG account is part of this leak, use HEROIC's free breach scanner. It checks your email address against more than 400 billion exposed records, including combolists like this one, so you can find out immediately and update any passwords that may be at risk.