The Biofam Leak Could Unlock Your Email, Bank, and Social Accounts

HEROIC found the Biofam database breach dated February 5, 2024, exposing 49,415 records including email addresses, phone numbers, usernames, first and last names, and password hashes from Biofam, a Russian online health and wellness ecommerce platform.

Why the Biofam Breach Is Dangerous

Health and wellness platforms hold data that is doubly sensitive: the personal details enable identity fraud, while the health-buying context can be used for targeted scams. Password hashes in this breach include MD5 with salt and bcrypt formats. MD5-hashed passwords remain crackable with modern hardware, and once recovered, those credentials can be used to access victims' email, banking, and social media accounts.

What Was Exposed in the Biofam Leak

• Email Address
• Phone Number
• Username
• First Name
• Last Name
• Password Hash

Why This Biofam Data Puts You at Risk

Phone numbers from this breach enable smishing attacks and SIM-swapping attempts that can bypass two-factor authentication on bank and email accounts. Cracked password hashes allow immediate credential stuffing across other services. Full names combined with email addresses make convincing phishing emails much easier to craft, increasing the likelihood of victims revealing additional sensitive information.

How Database Breaches Work

Database breaches occur when attackers exploit vulnerabilities in web applications or gain unauthorized access to backend systems, extracting stored user records. The stolen data is then published on dark web forums or sold to other criminals. Unlike stealer logs, database breaches expose everyone registered on a platform at once, regardless of whether they were actively using the service.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or credentials appeared in the Biofam leak or thousands of other breaches in our database.