Photogorky.ru Hack Exposes 38,136 Russian Photography Community Users

In August 2018, Photogorky.ru, a now-defunct Russian-language photography community and portfolio website, suffered a data breach that exposed 38,136 user records. The breach involved a database dump containing email addresses and plaintext passwords, which were subsequently compiled into combolists and distributed across underground criminal forums. Photogorky.ru served Russian-speaking photography enthusiasts who shared images, portfolios, and community content -- a user base with email addresses commonly linked to accounts on major Russian platforms including VKontakte, Yandex Mail, Mail.ru, and other services where credential reuse creates significant ongoing risk.

Why This Is Dangerous

Plaintext password storage is the most fundamental security failure a web platform can commit. When a database containing plaintext passwords is compromised, attackers gain immediate access to every user's actual password with no computational effort required. The 38,136 Photogorky.ru users affected by this breach had thier passwords exposed without any protective mechanism -- no hashing, no encryption, nothing standing between the stolen database and immediate credential use. Russian-speaking internet users who reused their Photogorky.ru password on VKontakte, Yandex, Mail.ru, Odnoklassniki, or banking applications face direct risk of account takeover across all those platforms. Photography community users often maintain accounts on image hosting platforms, cloud storage services, and social networks where their creative work and personal data are stored, all of which become targets once plaintext credentials are obtained. The breach data continues to circulate in active combolists years after the initial incident.

What Was Exposed

• Email addresses for 38,136 Photogorky.ru registered users
• Plaintext passwords stored without any hashing or encryption
• Account data from the Russian-language photography community platform
• Credentials compiled into combolists and distributed across underground forums

Why This Matters

Online photography communities attract users who invest significant time creating and curating content, and whose platform accounts may be linked to professional portfolios and client-facing work. The immediate usability of plaintext passwords means that every affected Photogorky.ru user was exposed to account takeover from the moment of the breach. Many users almost certainly never recieved any breach notification, as the platform subsequently ceased operations without any public disclosure. The plaintext credential data from this breach appears in active combolists targeting Russian-language email providers and social networks, where attackers use automated credential stuffing to access accounts with stored payment information, personal photographs, and private messages. The particulary high-risk nature of plaintext exposure means the 2018 breach continues to threaten affected users in 2026.

How Database and Combolist Breaches Work

A database breach typically occured when an attacker identified and exploited a vulnerability in the target platform -- commonly an SQL injection flaw, an unprotected administrative panel, or compromised server credentials. When the attacker exported the user database and found passwords stored in plaintext, they immediately possessed 38,000+ working email-password pairs that required no additional processing. These credentials were formatted into combolist files and distributed across criminal forums and Telegram channels, where automated credential stuffing tools use them to test logins against dozens of popular services simultaneously. Photogorky.ru's user data has followed this exact distribution pattern since 2018, appearing in multiple combolist compilations targeting Russian internet users.

Check If You Are Affected

If you ever registered an account on photogorky.ru to share photography, maintain a portfolio, or participate in the Russian photography community, your email address and actual password were exposed in this breach. Take these steps immediately:

• Search your email address in HEROIC's breach database to confirm whether your Photogorky.ru credentials appear in known breach datasets
• Change the password you used for Photogorky.ru on every platform where you used the same password
• Prioritize VKontakte, Yandex Mail, Mail.ru, Odnoklassniki, online banking, and any cloud storage accounts
• Enable two-factor authentication on all important accounts, especially email and financial services
• Monitor your accounts for unauthorized login attempts, unfamiliar posts, or unexpected activity
• Use a password manager to generate and maintain unique passwords for each account going forward

HEROIC's breach monitoring service alerts you in real time when your email address appears in newly discovered breach datasets and combolists. For photography community users whose plaintext passwords were exposed in the Photogorky.ru breach, monitoring remains essential given that this credential data continues to circulate in active criminal datasets years after the initial incident.