The Abv Bulgarian Mail Leak Happened in 2023. It’s Surfacing Now.

HEROIC analysts identified a combolist targeting Abv, a Bulgarian email provider, that was originally compiled around March 2023 but only surfaced on Telegram recently. The file contains 438,116 records, each pairing an email address with a plaintext password and a matching login URL.

Why This Is Dangerous

Data that sits quietly for years before surfacing publicly is still just as dangerous as a fresh leak, sometimes more so, since account holders have had years to forget the original incident ever happened. With 438,116 plaintext email and password pairs now circulating, anyone who never changed their password remains fully exposed.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

A gap of years between when data is compiled and when it becomes widely available is common with combolists, and it does not reduce the risk. If any of these 438,116 accounts still use the same password today, or if that password was reused on another site, credential stuffing attacks can succeed just as easily now as they would have in 2023 — leading to account takeover, identity theft, and financial fraud.

How Combolists Work

Combolists are compiled lists of email and password pairs gathered from breaches, phishing attempts, or malware infections, then organized by domain or provider and shared, sometimes long after they were first assembled. This particular file was grouped around Abv email accounts specifically, suggesting it was filtered from a larger pool of older breach data before making its way to Telegram.

Check If You Are Affected

If you have ever used an Abv email address, or any email with a password you have not changed in years, it is worth checking now. HEROIC's free breach scanner searches more than 400 billion leaked records to show you what has been exposed. Run a scan and update any old passwords you find.