What Hackers Can Do With Sofia University’s 2,960 Leaked Records

Sofia University's SPSF Portal Breach Exposes 2,960 Records

HEROIC analysts identified a breach connected to Sofia University, tied to a specialized portal for the Sophia Program for Sustainable Futures in Tokyo, Japan, dated August 26, 2018. The exposed dataset contains 2,960 records pairing email addresses with password hashes stored in an unspecified format. The data was compiled into a database and combolist format and shared on a hacking forum.

Why This Is Dangerous

Even a small dataset like this one gives attackers a targeted list of real, working email addresses tied to a specific academic program. Because the portal serves a defined group of students and staff, attackers can use the leak to run highly targeted phishing campaigns or attempt to crack the password hashes and log in directly.

What Was Exposed

• Email addresses
• Password hashes

Why This Matters

With a working email and cracked password, an attacker can attempt credential stuffing against email providers, banking sites, or other accounts where the same password may have been reused. Students and staff are also common targets for follow-up phishing emails that look like they come from the university itself, since the attacker already knows the victim's real affiliation.

How Database and Combolist Breaches Work

A database breach happens when attackers gain unauthorized access to a portal's backend systems and copy out stored user records. That data is often turned into a combolist, a simplified file pairing emails with passwords or password hashes for automated testing against other websites. Even a small, targeted leak like this one can be valuable to attackers precisely because it is tied to a specific, identifiable group of people.

Check If You Are Affected

If you have ever used Sofia University's SPSF portal, it is worth checking whether your email address appears in this leak. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including this incident, so you can quickly find out and update any passwords you may have reused elsewhere.