What Attackers Can Do with 20,877 Bullsteroids Records

In October 2025, HEROIC identified 20,877 records from Bullsteroids, an online French-language platform selling anabolic steroids, peptides, HGH, and EPO for bodybuilding. The data appeared on a Telegram channel and contained email addresses, usernames, and phpass password hashes.

Why the Bullsteroids Breach Is Dangerous

With email addresses, usernames, and password hashes from Bullsteroids, attackers can attempt to crack the phpass hashes offline and then use the recovered passwords to access email accounts, social media profiles, and any other service where victims reused the same credentials. The personal nature of the platform's services also makes affected users targets for extortion or blackmail based on their purchasing history.

What Was Exposed in the Bullsteroids Leak

• Email addresses
• Usernames
• Password hashes (phpass)

Why This Bullsteroids Data Puts You at Risk

Phpass hashes can be cracked using dictionary attacks and brute force tools. Once cracked, those passwords are tested against email providers, banking portals, and other services. Password reuse is the primary risk vector here -- a credential recovered from Bullsteroids becomes a key to any other account where that password was used.

How Database Breaches Work

Database breaches occur when attackers exploit vulnerabilities in web applications -- SQL injection, misconfigured access controls, or compromised admin credentials -- to extract the underlying user database. The stolen records are then packaged and distributed on hacking forums or Telegram channels for further exploitation.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or credentials appeared in the Bullsteroids leak or thousands of other breaches in our database.