What a Database Breach Means for Lekfarm’s 3,907 Pharmacy Users

In January 2025, HEROIC identified 3,907 records from Lekfarm, a Ukrainian online pharmacy. The data was posted on a Telegram channel and contained email addresses, phone numbers, full names, birthdays, gender, IP addresses, and MD5-salted password hashes.

Why the Lekfarm Breach Is Dangerous

When an online pharmacy is breached, attackers gain more than login credentials -- they gain a comprehensive profile of each user. Full names, phone numbers, birthdays, and gender combined with email addresses enable highly targeted phishing and social engineering. The MD5-salted password hashes, while slightly harder to crack than unsalted MD5, are still vulnerable to brute force attacks using the salts exposed in the same dataset.

What Was Exposed in the Lekfarm Leak

• Email addresses
• Phone numbers
• First and last names
• Birthdays
• Gender
• IP addresses
• Password hashes (MD5 + salt)

Why This Lekfarm Data Puts You at Risk

The combination of PII and salted MD5 hashes makes this breach particularly actionable for attackers. Salts were exposed in the same dataset, allowing offline cracking attempts with the correct salt applied to each hash. Once passwords are recovered, they are tested across email, banking, and social media accounts. The pharmacy context also makes users targets for health-related phishing and prescription fraud.

How Database Breaches Work

Database breaches occur when attackers exploit vulnerabilities in web applications -- SQL injection, misconfigured access controls, or compromised admin credentials -- to extract the underlying user database. The stolen records are then packaged and distributed on hacking forums or Telegram channels for further exploitation.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or credentials appeared in the Lekfarm leak or thousands of other breaches in our database.