Igakutushin Data Breach Exposes 28K Japanese Medical Publisher Records

HEROIC's DarkHive system discovered the Igakutushin breach, exposing 28,785 records in August 2018. This Japanese medical publisher and online bookstore suffered a database compromise that revealed customer email addresses and MD5 hashed passwords belonging to healthcare professionals and medical students who purchased publications through this specialized academic platform.

Why This Is Dangerous

A breach at a medical publisher is particularly sensitive because its customer base consists primarily of healthcare professionals, medical researchers, and students whose identities carry high value for impersonation fraud. MD5 password hashing without salting, which was widely used at the time of this breach, provides minimal protection against modern cracking hardware and rainbow table attacks. Healthcare professionals whose credentials were exposed face risk of identity fraud that could affect their professional licensing and medical credentials.

What Was Exposed

• Email Address
• Password Hash (MD5)

Why This Matters

The exposure of healthcare professional email addresses enables highly targeted phishing attacks impersonating medical associations, licensing boards, or pharmaceutical companies. Credential stuffing attacks using these email and cracked password combinations may target medical databases, prescription systems, or hospital networks if users reused their credentials. The specialized nature of this platform's user base makes each affected record more valuable to attackers than records from general consumer databases.

How Database and Combolist Breach Works

Database breaches at specialized publishers typically occur through exploitation of web application vulnerabilities in e-commerce or content management platforms. Extracted records are combined with data from other breaches to form combolists, which credential stuffing operators use to test login combinations across multiple services simultaneously. Medical and academic platforms are increasingly targeted because their users tend to have elevated access privileges within institutional networks.

Check If You Are Affected

HEROIC offers a free identity scanner searching over 400 billion records including data from the Igakutushin breach. Visit heroic.com to check if your information was exposed.