Canada Nursing Jobs Reportedly Breached, 2,120 Logins Risking Fraud
HEROIC analysts reportedly identified a file tied to Canada Nursing Jobs, a job-board business, that surfaced in August 2023 and exposed 2,120 records containing email addresses and plaintext passwords. The data appears to have circulated first on a hacking forum and later through Telegram channels. Scanning your email is the only reliable way to know if your information is included.
What Was Exposed
Key finding100% of records pair an email address with a password.
What the Canada Nursing Jobs File Contains
- Email Address: gives an attacker a confirmed contact to target with phishing or impersonation.
- Plaintext Password: ready for immediate use, with no decryption needed.
How This Can Turn Into Fraud
If the exposed password is reused on an email provider, an attacker can log in directly and reset passwords on other services linked to that address. From there, fraudulent job offers, redirected payments, or identity theft attempts become realistic outcomes. Nurses and healthcare job-seekers are also attractive phishing targets given the sensitive workplaces they're tied to.
Data exposed in this breach
Email addresses appear in 100% of the 2,120 records in this breach, alongside plain-text passwords (100%). 100% of records (2,120) pair an email address with a password.
An email address and password together are a working login. Attackers feed pairs like these into automated tools that try them on banking, shopping and email sites, so anyone who reused the password elsewhere is exposed there too.
- Domain
- canadanursingjobs.com
- Date leaked
- 01 Aug 2023
- Records in breach
- 2,120
Email providers and account types
45.7% of the email addresses in this breach are personal mailboxes and 54.3% are work addresses. The most common provider is hotmail.com, followed by gmail.com and yahoo.com.
Work addresses matter because a password reused on a company account can give attackers a way into that organisation. The company domains below show which employers appear most often.
Mailbox type
- Personal mailboxes45.7%
- Work mailboxes54.3%
Email providers
- 1hotmail.com389
- 2gmail.com187
- 3yahoo.com89
- 4rogers.com78
- 5yahoo.ca74
- 6sympatico.ca65
- 7cogeco.ca26
- 8msn.com10
- 9mail.ru9
- 10aol.com8
- 11yahoo.co.in4
- 12yandex.ru3
- 13yahoo.co.uk3
- 14yahoo.com.au2
- 15rambler.ru2
Company domains
| # | Domain | Accounts | Share of records |
|---|---|---|---|
| 1 | sunnybrook.ca | 106 | 5% |
| 2 | gawab.com | 50 | 2.4% |
| 3 | chartwellreit.ca | 21 | 1% |
| 4 | ryerson.ca | 15 | 0.7% |
| 5 | niagarahealth.on.ca | 14 | 0.7% |
| 6 | uwo.ca | 11 | 0.5% |
| 7 | confederationc.on.ca | 10 | 0.5% |
| 8 | lhsc.on.ca | 10 | 0.5% |
| 9 | torontorehab.on.ca | 9 | 0.4% |
| 10 | mycampus.uoit.ca | 8 | 0.4% |
| 11 | uwindsor.ca | 8 | 0.4% |
| 12 | utoronto.ca | 7 | 0.3% |
| 13 | benchmarkitsolutions.com | 7 | 0.3% |
| 14 | trentu.ca | 6 | 0.3% |
| 15 | gaagle.name | 6 | 0.3% |
Password Analysis
Key finding12.4% of passwords in this breach are reused, and 37.3% are 8 characters or fewer.
Why Plaintext Logins From a Job Board Carry Extra Risk
Because the passwords here are stored as plain, readable text, they can be used the moment the file is opened, with no cracking required. An attacker will often test the same email and password pair against other services, counting on password reuse. For job-seekers, a compromised email login can also expose resumes, references, or other job-search correspondence sitting in that inbox.
How Login Records Like These Get Collected
A leak of this kind typically starts with unauthorized access to a service's own stored records, which are then copied out in bulk rather than gathered one device at a time. The resulting file is traded across forums that specialize in stolen data before wider distribution through Telegram. That bulk nature is why a single incident can touch thousands of unrelated people at once.
Is Your Login Part of the Canada Nursing Jobs File?
Use the scan your email tool above to check your address against this and other reported leaks. If you recognize the password as one you still use, change it on every service where you've reused it, starting with your email. Run the same check against any work email tied to healthcare employers, since the risk applies there too.
Password strength
Of the 2,120 passwords analysed, 12.4% appear more than once, and the single most common password accounts for 5.6% of them. The average password is 10.2 characters long.
92.7% contain no special character, 2.1% are numbers only and 31.1% are lowercase letters only. Passwords built this way are the first ones cracking tools try, which is why length and a mix of character types matter.
Password habits
Password length
The most common length is 13-16 characters, covering 21.5% of passwords. 37.3% are 8 characters or fewer, while only 4.7% reach 17 characters or more.
Every extra character multiplies the number of guesses an attacker needs. Passwords of 8 characters or fewer can be cracked quickly once they leak, while long passphrases hold up far better.
Share of passwords by length
- 8 characters or fewer
- 9 characters or more
Most common passwords
The most common password appears 118 times, and the top 15 together account for 164 uses. Passwords are masked here: only their first characters are shown, next to each password's true length.
When many accounts share one password it usually points to a default password, a shared team password or a common pattern such as a name followed by numbers. Treat any password on this list as public.
- 1a****5 chars118
- 212****6 chars4
- 3mer**********13 chars4
- 4he****6 chars4
- 52w******8 chars4
- 6ho******8 chars4
- 7re******8 chars3
- 8re*****7 chars3
- 912*******9 chars3
- 10sh******8 chars3
- 11t4******8 chars3
- 12w12********11 chars3
- 13ch********10 chars3
- 14r****5 chars3
- 15HR*******9 chars2
Leaked in this breach: email address, plaintext password
Is your email in the Canada Nursing Jobs leak?
Check your email against this breach and billions of other leaked records. If it shows up, we'll tell you exactly what to change.
Scan my email2,120 records in this breach
- Instant
- Free
- Private
/img/qr-code.png)