The Work in Lviv Breach Put 11,356 Email and Password Pairs Online

HEROIC analysts identified a database leak from Work in Lviv, a Ukrainian employment platform listing jobs and vacancies in the city of Lviv. The data surfaced on a hacking forum, tracing back to August 26, 2018, and exposed 11,356 records made up of email addresses and plaintext passwords.

Why This Is Dangerous

Because Work in Lviv stored passwords in plaintext, there was no hashing standing between the leaked data and the accounts it belonged to. Anyone with this dataset can read every password directly and pair it immediately with the matching email address, with no cracking required.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

Job seekers often reuse the same password across their email, banking, and other job search accounts, which is exactly what makes a leak like this one so useful for credential stuffing. If any of the 11,356 people in this leak reused their Work in Lviv password elsewhere, they remain at risk of account takeover, identity theft, or financial fraud on accounts that have nothing to do with the original job platform.

How This Database Leak Happened

This incident is classified as a database and combolist leak, meaning attackers pulled the data directly from Work in Lviv's backend, likely through a vulnerability in the site itself, and compiled it into a combolist, a simple list of email and password pairs built for reuse. Because the passwords were never hashed, this leak went straight from database dump to fully usable credential list.

Check If You Are Affected

If you ever used Work in Lviv or reused a password across multiple sites, HEROIC's free breach scanner can check your email address against a database of more than 400 billion leaked records, including this one. Run a scan now to see if your information was exposed.