Dark Web Drop: Lekafarm Pharmacy Leaked 17,588 Russian Records

HEROIC discovered 17,588 records in Лекафарм (Lekafarm) on 8 January 2025, leaking email addresses, phone numbers, first names, last names, and MD5 password hashes from the Russian online pharmacy. The dataset quickly found its way onto Russian-language dark web forums where pharmaceutical customer data is traded for targeted scams.

Why This Database Breach Is Dangerous Given the MD5 Hashing

This breach is dangerous because MD5 is a decades-old hashing algorithm that modern GPUs can crack at billions of guesses per second. Combined with real names, phone numbers, and verified emails tied to a pharmacy, attackers can rebuild full identities, craft medical-themed phishing scams, or call victims directly pretending to be pharmacists.

What Was Exposed in Лекафарм (Lekafarm)

• 17,588 Lekafarm pharmacy customer records
• Email addresses verified as active
• Russian mobile phone numbers
• First and last names written in Cyrillic
• MD5 password hashes that are effectively plaintext against modern hardware

Why This Matters

Pharmacy breaches carry extra weight because medical purchase history implies health conditions that can be used for extortion, pharmacy refill scams, or targeted phishing for insurance and banking credentials. Weak MD5 hashing means attackers can recover most passwords in hours, then probe unrelated services for reuse.

How Database Breaches Work

Database breaches against online pharmacies like Lekafarm usually start with an SQL injection, a vulnerable content management plugin, or admin credentials stolen through earlier stealer malware. Once the attacker has the user table, they export the data, stage it on their own infrastructure, and publish or sell it on dark web forums that cater specifically to Russian-speaking buyers.

Check If You Are Affected

HEROIC scans more than 400 billion compromised records, including the Lekafarm dataset, so you can see in seconds whether your email, phone, or password hash appear in this pharmacy breach. Run a free HEROIC scan, change any Lekafarm password you have reused elsewhere, enable multi-factor authentication on webmail and banking, and stay alert to any pharmacy-themed calls or messages.