Dark Web Intel: Pensoft Database Leak Exposed 6,271 Records

HEROIC analysts identified a database breach connected to Pensoft, the Bulgaria-based scientific publishing platform at pensoft.net. The breach dates to March 1, 2016, and exposed 6,271 records. Passwords in the database were protected with SHA-1 hashing, an algorithm that modern security standards have since moved away from.

Why the Pensoft Breach Is Dangerous

SHA-1 was once considered acceptable for password storage, but it has since been shown to be crackable with modest computing power, especially when used without additional protections like salting. An attacker who gets hold of a SHA-1 password hash can run automated cracking tools against it and, in many cases, recover the original password in a relatively short amount of time. From there, that password can be tried against other accounts belonging to the same person.

What Was Exposed in the Pensoft Leak

• 6,271 total records from the pensoft.net platform
• Account passwords stored using SHA-1 hashing
• Records tied to a Bulgaria-based science and technology organization

Why This Matters Even for a Small Breach

It's tempting to dismiss a breach this size, but scale isn't the only measure of risk. The 6,271 people in this database work in or around science and technology, and a cracked password tied to their name is just as useful to an attacker as one from a much larger leak. If any of those passwords were reused on a work email account or another platform, that account is exposed too, and attackers routinely test stolen credentials across many services at once through credential stuffing.

How a Database Breach Like This Happens

A database breach typically starts with an attacker finding a weakness in a website's software, an exposed admin panel, or a server that wasn't properly locked down. From there, they extract the user table directly, hashes and all, and move it to their own systems to analyze at leisure. Once the data is out, weaker hashing algorithms like SHA-1 make it far easier for attackers to turn stolen hashes into usable passwords.

Check If You're Affected

If you've ever had an account on pensoft.net, it's worth checking whether your information shows up in this or any other breach. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to tell you where your information has surfaced.