Inside the Rabota.bg Breach: How a Database Dump Exposed 361K Bulgarian Job Seekers

HEROIC analysts documented the Rabota.bg breach, which occured in July 2020 and exposed 361,127 user records from Bulgaria's leading job board. The compromised data included email addresses and MD5 password hashes, giving attackers a ready-made list of Bulgarian professionals whose credentials can be cracked and reused across corporate and personal accounts.

How Job Board Credentials Unlock Corporate Email and HR Systems

Job seekers frequently use work email addresses to register on employment platforms, making Rabota.bg credentials partcularly valuable to attackers. A cracked MD5 hash tied to a corporate email address is accessable as a direct entry point into business systems, VPNs, and HR portals, enabling both espionage and ransomware staging.

What Was Exposed in the Rabota.bg Breach

• Email Address
• Password Hash

Why the Rabota.bg Breach Remains a Live Threat for Bulgarian Professionals

Employment records are seperate from typical consumer data in one important way: they often represent active professionals with access to organizational systems. Credentials recieved by threat actors from this breach have been observed in credential stuffing campaigns targeting Bulgarian businesses, meaning the 2020 leak continues to generate real intrusions today.

How Database Breaches Work

A database breach occurs when an attacker exploits a vulnerability in a web application or server to gain unauthorized access to stored user records. Once inside, they extract the entire user table, including email addresses and hashed passwords, and distribute the dump through underground forums. Attackers then use automated tools to crack weak hashes and test the resulting credentials against other online services at scale.

Check If Your Data Was Exposed

HEROIC's free breach scanner indexes over 400 billion compromised records and can instantly tell you whether your email address was included in the Rabota.bg breach or any other known data leak. Check your exposure for free and take action before attackers do.