Inside the Bulgaria 8 Combolist: How 45,641 Passwords Got Leaked

HEROIC analysts identified a combolist file labeled "Bulgaria 8" that a Telegram user uploaded on February 18, 2023. The file contains 45,641 records pairing email addresses with plaintext passwords, along with URLs showing which sites each login was tied to.

Why This Is Dangerous

Because the passwords in this file are plaintext rather than hashed, there is no code to break. Anyone who opens the file sees each login exactly as its owner typed it, and the attached URL points straight to the site it belongs on. That combination turns a simple text file into a working set of keys for tens of thousands of accounts.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each credential to the site it was used on

Why This Matters

Data like this feeds directly into credential stuffing, where automated tools test each email and password pair against banking sites, email providers, and online stores. Since so many people reuse the same password across accounts, a single leaked credential can lead to account takeover on services that were never breached themselves, opening the door to identity theft and financial fraud.

How a Combolist Like This Gets Made

A combolist is built by taking username or email and password pairs, usually pulled from older breaches, stealer logs, or other leaked data, and combining them into a single, easy-to-use file. It strips away everything except the login pairs, which is exactly why it moves quickly into automated attack tools once it starts circulating. Telegram channels dedicated to sharing and trading these files are a common source for combolists like this one.

Check If You Are Affected

If you think your email address might be part of this combolist or a similar leak, HEROIC's free breach scanner checks your information against a database of more than 400 billion compromised records. Run a scan and update any password you have reused on more than one site.