Search Your Email: The CTARS Breach Exposed 11,846 Health Records With Passwords

HEROIC analysts identified the CTARS database leak in May 2021, when records from the Australian NDIS client management platform were posted to a hacking forum. The breach exposed 11,846 records containing email addresses, password hashes, salts, and dates of birth belonging to care providers and participants on the CTARS cloud system. Health-sector breaches are partcularly alarming given the sensitivity of the data involved.

Why Hashed Passwords and Birthdays Together Are Dangerous

Password hashes with salts can be cracked using modern GPU-based attacks, especially if weak passwords were used. When combined with dates of birth, attackers have enough to attempt identity verification bypasses at banks, government portals, and health services. This data combination is recieved by threat actors as a premium package for targeted fraud and account takeover.

What Was Exposed in the CTARS Breach

• Email Address
• Password Hash
• Salt
• Birthday

Why a Health Platform Breach Carries Elevated Risk

CTARS serves as a management system for Australia's National Disability Insurance Scheme, meaning the affected individuals include some of the most vulnerable members of the population. Credential stuffing attacks using cracked password hashes can lead to account takeover across other services. The birthday data enables identity theft and financial fraud, and the consequences occured far beyond the platform itself for many affected users.

How a Database Breach Works

A database breach happens when an unauthorized party gains access to a cloud or on-premise data store, extracts records in bulk, and distributes them on underground forums. The attacker may exploit application vulnerabilities, misconfigured cloud storage, or compromised credentials. Health platforms are high-value targets because the data they hold is both sensitive and long-lasting.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches 400 billion+ compromised records, including the CTARS leak. Search your email address now at heroic.com to find out whether your information was exposed in this or any other data breach.