The Boris Miksic Dump: 13,453 Plaintext Login Credentials Hit the Dark Web

In August 2018, Boris Miksic, a Croatian online portal, experienced a data breach that exposed over 13,000 user records. The breached data included email addresses and passwords stored in plaintext, one of the most dangerous combinations a breach can produce. The dataset was posted to a prominent hacking forum and has recently resurfaced in active combolist compilations, indicating that threat actors continue to find value in this older data. For the 13,453 people whose credentials were exposed, the threat is not historical. It is ongoing.

Why This Is Dangerous

Plaintext passwords require no cracking. The moment this dataset was exfiltrated, every single credential in it was immediately usable. Attackers do not need specialized tools or computing power to exploit a plaintext breach. They simply load the email and password pairs into a credential stuffing tool and start testing against live services. The Boris Miksic breach provids attackers with 13,000 ready-to-fire credentials that have been in circulation for years, multiplied by every combolist they have been folded into since.

What Was Exposed

• 13,453 user records in total
• Email addresses from registered accounts
• Passwords leaked in plaintext with no encryption or hashing
• Platform operated as an online portal in Croatia
• Data classified as Database and Combolist breach type
• Originally leaked August 21, 2018

Why This Matters

Croatia is a member of the European Union, meaning data protection obligations under GDPR apply retroactively to how this breach is handled today. Beyond legal implications, the users affected by this breach are real individuals who likely reused their Boris Miksic password on other platforms. Password reuse is the mechinism that turns a small breach into a large-scale account takeover campaign. The reappearance of this dataset on active hacking forums means those credentials are being tested against European banking, email, and e-commerce platforms right now.

How Dark Web Credential Dumps Work

When a database breach occurs, the extracted data typically moves through a predictable path: initial sale or trade on private forums, redistribution on wider hacking communities, and eventual absorption into large combolist compilations. These compilations are sold, shared, and used in automated credential stuffing attacks. The Boris Miksic data followed this exact trajectory. From a single database dump in 2018, the data was posted publicly, picked up by aggregators, and continues to appear in new combolist pacakges today. Each new compilation gives attackers a fresh opportunity to weaponize credentials that users have never bothered to change.

Check If You Are Affected

HEROIC's free breach scanner checks your email against more than 400 billion exposed records, including the Boris Miksic dataset and thousands of other verified dark web leaks. If your email appears in this breach or any connected combolist, HEROIC will detect it immediately. Given that passwords were stored in plaintext, the urgency of checking your exposure cannot be overstated.