Medical Supplies Center

We've been tracking the resurgence of older breaches appearing in new combolists, and the Medical Supplies Center breach from August 2018 stood out. What caught our attention wasn't the size of the breach – approximately 12,500 records – but the exposure of passwords in plaintext. In an era where even basic hashing algorithms are expected, plaintext storage signals a significant lapse in security practices, raising concerns about other potential vulnerabilities within the organization’s infrastructure and data handling. This also suggests the company has not adequately improved their security posture in the intervening years, making them a soft target today.

Medical Supplies Center Breach: 12,492 Records with Plaintext Passwords Exposed

The Medical Supplies Center, a US-based e-commerce platform, experienced a data breach in August 2018. The breach exposed approximately 12,492 unique records, including email addresses and, critically, passwords stored in plaintext. This data surfaced on a prominent hacking forum, making it readily available to malicious actors. The use of plaintext passwords is a major red flag, indicating outdated or inadequate security measures and significantly increasing the risk of account compromise and credential stuffing attacks across other platforms.

Key point: Total records exposed: 12,492

Key point: Types of data included: Email addresses, Plaintext passwords

Key point: Sensitive content types: Potentially PII related to medical supplies purchases

Key point: Source structure: Likely a database dump, format unspecified in initial reporting

Key point: Leak location: Prominent hacking forum (specific URL unavailable but can be inferred via search)

Key point: Date of first appearance: August 2018

External Context & Supporting Evidence

While the breach itself occurred in 2018, the re-emergence of this data in current combolists highlights the long tail of risk associated with poor security practices. Security researcher Troy Hunt maintains a data breach tracking website known as "Have I Been Pwned" (HIBP) where he has documented this breach. Users are able to search their email addresses to see if their information has been compromised in known data breaches, including the Medical Supplies Center breach. This breach is a stark reminder that even smaller breaches can have significant consequences when basic security principles are ignored. The continued availability of plaintext passwords from this incident represents an ongoing threat to individuals and organizations alike.

Email · Address · Plaintext · Password