Identity Theft Just Got Easier Because of the Percovision Breach: 106K Users at Risk

HEROIC analysts occured upon the Percovision breach while cross-referencing a cluster of Bulgarian platform leaks that resurfaced in credential trading forums during late 2018. The breach, which dates to August 26, 2018, exposed 106,515 user records from Percovision, a Bulgarian online platform. The compromised data included email addresses and PHPass password hashes, packaged into a database dump that has continued circulating across breach compilation lists ever since.

Why PHPass Hashes from Percovision Remain a Threat

PHPass was considered an improvement over MD5 when it was introduced, but modern hardware has made it accessable to attackers using GPU-accelerated cracking rigs. Criminals who obtain this data can systematically attempt to crack the hashes, then test the recovered passwords across email, e-commerce, and financial platforms where Percovision users may have reused identical credentials.

What Was Exposed in the Percovision Breach

• Email Address
• Password Hash

Why the Percovision Breach Keeps Feeding New Attacks

Old breaches do not expire. The Percovision data has been folded into aggregated credential lists used by automated bots that run credential stuffing attacks around the clock. Victims who never changed the password they used on Percovision remain at ongoing risk of account takeover, identity theft, and financial fraud every time those lists are recycled into a new attack campaign. The fact that the platform is now defunct offers no protection, because the data itself never went away. Many users seperate their logins mentally by site but reuse the same actual password, which is exactly the vulnerability attackers exploit.

How Database Breaches Work

A database breach happens when an attacker exploits a vulnerability in a web application or its underlying infrastructure to gain unauthorized access to the server's database. Common methods include SQL injection, exploitation of unpatched software, and compromise of administrative accounts. Once the attacker has access, they extract user tables and export the raw data. That data is then sold on dark web marketplaces or shared freely in underground forums, where it fuels downstream attacks for years after the initial incident.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against more than 400 billion compromised records, including the Percovision breach. Run a free scan at HEROIC today to find out whether your credentials are already in the hands of attackers and take action before your accounts are targeted.