5,729 Phone Numbers and Emails Leaked in the BodyAssist Breach

HEROIC analysts recieved data on November 19, 2022 revealing a breach at BodyAssist, an Australian eCommerce platform specializing in health and wellness products. The incident exposed 5,729 records containing email addresses, phone numbers, first names, and last names. The presence of phone numbers alongside full names and email contacts significantly raises the risk profile of this breach, as it enables multi-channel attacks including SMS phishing and voice-based social engineering targeting real customers by name.

Phone Numbers and Names: A Multi-Channel Attack Surface

When phone numbers are included in a leaked dataset alongside full names and email addresses, attackers gain the ability to launch coordinated phishing campaigns across multiple channels at once. SMS messages posing as BodyAssist support or delivery notifications become highly convincing when they address recipients by their real name. This type of multi-vector approach is partcularly effective at bypassing user skepticism and extracting sensitive information or payments.

What Was Exposed in the BodyAssist Breach

• Email Address
• Phone Number
• First Name
• Last Name

Why Health and Wellness Data Breaches Carry Extra Risk

Customers of health-focused platforms may be beleived to be more susceptible to targeted scams that exploit their interest in wellness products. Fraud schemes, fake supplement offers, and identity theft attempts are all more credible when attackers already know a victim's name, email, and phone number from the BodyAssist breach. Credential stuffing across health and retail platforms is also a common downstream use for this type of data.

How a Database Breach Works

A database breach occured when an attacker gains unauthorized access to a backend data store, using methods such as SQL injection, compromised credentials, or exposed APIs. Customer records are extracted silently and exported to external storage. The stolen data is typically posted or sold on dark web forums within days of the initial intrusion, with affected users often unaware for weeks or months.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion compromised records to determine whether your email address or phone number appeared in the BodyAssist breach or any other documented incident. Check now and take the steps needed to protect your accounts.