Zero Encryption. 11,149 Passwords. The Work in Khmelnytskyi Leak.

HEROIC analysts identified a dataset from Work in Khmelnytskyi, a Ukrainian employment platform listing local jobs and vacancies, circulating on a hacking forum. Discovered on August 26, 2018, the dataset contains 11,149 records, each pairing an email address with a password stored in plaintext.

Why This Is Dangerous

There is no hashing, salting, or any other protection standing between an attacker and these passwords. The moment this file was exposed, every single password in it became instantly usable, with no cracking step required at all. That is about as bad as password storage gets, and it means the risk to affected users was immediate rather than something that develops slowly over time.

What Was Exposed in the Work in Khmelnytskyi Breach

• Email addresses
• Plaintext passwords

Why This Matters for the 11,149 People Affected

Job seekers often reuse the same password across email, banking, and other job sites, since job hunting frequently means creating accounts on several platforms in a short span of time. With plaintext passwords exposed and ready to use, attackers can move straight to credential stuffing, account takeover, identity theft, or financial fraud on any account where the password was reused.

How This Database Breach Happened

This incident is classified as a database and combolist breach, meaning attackers obtained a direct copy of the site's user table, likely by exploiting a vulnerability such as SQL injection in the platform's backend. The fact that passwords were stored in plaintext rather than hashed points to a basic security oversight that made the eventual breach far more damaging than it needed to be.

Check If You Are Affected

To find out if your email address or password appears in this leak or any other, run a free scan with HEROIC's breach checker, which searches a database of more than 400 billion leaked records.