Spine Clinic Leak Leaves 347 Indian Patients Exposed Online

HEROIC analysts confirmed the American Spine and Medical Institute breach on February 4, 2025, after a database extract from the Indian clinic (americanspine.in) appeared on a dark web marketplace. The leak exposed 347 patient records with email addresses, phone numbers, first and last names, and IP addresses.

Why This Medical Breach Is Dangerous

Even a small healthcare leak carries outsized risk. A record that names a patient and the clinic is tacit disclosure that the person sought spine surgery or pain management care. Attackers can build convincing medical-themed phishing against patients who are already in clinical touch points.

What Was Exposed in the American Spine and Medical Leak

• Email addresses used to book appointments
• Phone numbers tied to patient profiles
• First names and last names
• IP addresses captured at form submission

Why This Matters

The contact set powers phishing that mimics clinic outreach, voice scams offering fake prescription discounts, identity theft when combined with other leaks, and medical billing fraud that targets the patient or their insurer. The IP address adds location context that can tighten targeting further.

How Database Breaches Work

Small clinic platforms often rely on legacy PHP, outdated plugins, and weakly protected admin panels. Attackers use SQL injection or leaked credentials to export the patient table, then list the data on underground marketplaces. Medical records draw premium prices because they stack identity, health context, and contact details in one record.

Check If You Are Affected

If you have interacted with a medical provider in India, scan your email free against HEROIC's 400 billion plus exposure index to see whether your data has surfaced in this or related leaks.