e-HealthLinks Breach Contains 177,831 Email and Password Hash Records

HEROIC analysts identified the e-HealthLinks breach while monitoring dark web forums where older health-sector credential dumps had been repackaged and shared in credential stuffing circles. The breach occured in June 2017, exposing 177,831 user records from e-HealthLinks, a now-defunct U.S.-based website that curated health information and resources. The compromised data included email addresses and pHpass password hashes. While pHpass is stronger than older hashing methods, it is not immune to cracking, and the reemergence of this data in active trading channels suggests attackers beleive these credentials still have value against users who recycle passwords.

Why Health Site Credentials Are a High-Value Target

People who register on health-related websites often use the same email and password they use for medical portals, insurance accounts, and pharmacy platforms. Attackers who crack a password hash from the e-HealthLinks breach gain a credential that is likely to work on platforms holding far more sensitive information. A cracked e-HealthLinks password could open doors to prescription records, insurance claims, or personal health history on other sites. Email addresses from health platforms are also seperate from general marketing lists and can be used for highly targeted phishing campaigns designed to look like medical alerts or appointment reminders.

What Was Exposed in the e-HealthLinks Breach

• Email Address
• Password Hash

Why This Breach Poses an Ongoing Risk

Even though e-HealthLinks no longer operates, the 177,831 email and password hash pairs from this breach continue to circulate. Attackers bundle old dumps like this one into large credential stuffing lists that are tested against active login pages automatically. If your e-HealthLinks password was short, common, or reused elsewhere, there is a real chance it has already been cracked and tested against your other accounts. Health data breaches carry an extra layer of risk because users tend to be less aware of them, leaving compromised accounts unaddressed for years.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a website's backend data storage. This commonly happens through vulnerabilities in the website's code, unpatched software, or stolen administrative credentials. Once inside, the attacker copies the user database, which contains whatever data the site collected at registration. For e-HealthLinks, that meant email addresses and password hashes. The attacker then takes that data offline and either cracks the hashes, sells the raw dump to other criminals, or uses it directly in automated credential stuffing attacks against other websites.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against more than 400 billion exposed records, including the e-HealthLinks breach. Run a free scan at HEROIC to find out if your data is in circulation and get straightforward guidance on which accounts to secure right now before attackers use your old credentials against you.