The Candor Health Breach: 2,233 Passwords Exposed. Yours Might Be One.

HEROIC analysts have added the Candor data breach to our records. Candor, a US-based health platform and mobile application at candor.health, was breached on January 24, 2023, in an incident reported to affect over 462,000 records systemwide, with 2,233 unique user records confirmed exposed in the leaked file. The compromised data includes email addresses, usernames, gender, and password hashes secured with bcrypt, which were later shared on a prominent cybercrime forum.

Why This Is Dangerous

Unlike a plaintext password leak, these 2,233 passwords were protected with bcrypt hashing, which makes them much harder to crack. That does not mean they are safe. Attackers with specialized hardware can still attempt to crack weak or common passwords out of a bcrypt hash, and the email addresses, usernames, and gender data exposed alongside them are usable on their own for targeted phishing and identity theft, especially since this data came from a health platform.

What Was Exposed

• Email addresses
• Usernames
• Gender
• Password hashes (bcrypt)

Why This Matters

Health platform data is especially valuable to attackers because it combines personal identifiers with details people consider private. Even with bcrypt hashing, a weak or reused password can eventually be cracked, and once that happens the same credential stuffing playbook applies: attackers test the recovered password against email, banking, and social media accounts. The combination of a real email address, username, and personal detail like gender also makes convincing phishing messages easier to write.

How This Database Breach Happened

Candor's incident is classified as a database breach, meaning attackers gained direct access to the platform's user records rather than harvesting them one at a time through malware. Once obtained, the stolen records were shared on a cybercrime forum, where they remain available to anyone looking to mine them for usable credentials or personal details, regardless of how the passwords were originally hashed.

Check If You Are Affected

If you ever used the Candor health app, your email, username, and hashed password may still be circulating on cybercrime forums today. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including the Candor breach, so you can find out quickly whether your information was exposed.