Analysts Find the Bulgaria Corp Mail Sample Leak: 1,065 Accounts

In February 2026, HEROIC analysts found a Telegram upload labeled Bulgaria Corp-Others-Pro Mails Test Sample, containing 1,065 records of email addresses, plaintext passwords, and the URLs tied to each credential pair. The test sample naming suggests this file was shared as a preview of a larger dataset the uploader planned to sell. Why is this dangerous? Sample files like this one are often used to prove a larger dataset is real before the full file is sold privately. That means the 1,065 accounts here may only be a fraction of what was actually compromised, and the plaintext passwords in this sample can be used immediately against corporate or personal accounts tied to those addresses. What was exposed: corporate and business email addresses, plaintext passwords, and URLs linked to each credential pair. Why this matters: corporate email accounts are especially valuable to attackers because they often unlock access to internal systems, financial tools, and client data, not just a personal inbox. A leak like this can lead to business email compromise, financial fraud, and further breaches if any of these credentials are still active. How this combolist was built: sample combolists are typically pulled from a larger stolen dataset and released for free or at a low price to demonstrate its authenticity to potential buyers. The rest of the data is then usually sold privately on dark web forums or through direct Telegram messages, away from public channels. Check if you are affected: if you use a business email address, it is worth checking now rather than waiting for the rest of this dataset to surface. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including samples like this one, so you can secure your accounts before the full file appears.