MRCVSonline Security Breach Exposes 15K UK Veterinary Professional Accounts

DarkHive discovered a data breach affecting MRCVSonline, a UK-based professional platform operating at mrcvs.co.uk that provides tools, news, and commentary for veterinary professionals. The breach exposed 15,510 user records and was dated March 19, 2018. Leaked data included email addresses and password hashes of an unspecified type. Veterinary professionals who registered on the platform had their account credentials exposed, with the breach representing a targeted risk to a specialized healthcare-adjacent professional community.

Why This Is Dangerous

Professional healthcare platforms hold accounts belonging to veterinarians, veterinary nurses, and veterinary practice staff who frequently use the same email address and password across multiple professional systems. A compromised MRCVSonline account password can be tested against practice management software, continuing education portals, and professional registration systems. The unspecified hash type is concerning: if older or weaker hashing algorithms were used, the passwords may be crackable using modern tools. Healthcare-adjacent professionals are high-value targets for credential stuffing because thier accounts often have access to sensitive clinical and financial systems.

What Was Exposed

• Email addresses
• Password hashes (type unspecified)

Why This Matters

Professional community platform breaches carry elevated long-tail risk because affected users tend to maintain consistent email addresses and reuse passwords across multiple professional systems for years. Veterinary professionals registered with thier practice email addresses remain at risk of credential stuffing attacks targeting veterinary practice management software, prescription systems, and professional development portals. Even though this breach occured in 2018, the exposed credentials have circulated in combolists and remain actionable today for any user who has not changed thier password since registration.

How Database Breach Works

In a database breach, attackers exploit vulnerabilities in web application code, unpatched CMS software, or database misconfigurations to extract stored user records. Professional niche platforms with limited dedicated security resources are particulary susceptible to exploitation. Once the database is extracted, the email addresses are immediately usable for targeted phishing campaigns against veterinary practices, while the password hashes are subjected to cracking attempts using tools like Hashcat. The recovered credentials are compiled into professional-focused combolists and tested against healthcare and professional services platforms in automated stuffing campaigns.

Check If You Are Affected

HEROIC offers a free identity scanner that checks your email address against thousands of known breach databases, including professional community platform leaks like MRCVSonline. If your credentials were exposed, you will recieve an alert identifying affected accounts and guidance on securing your professional and clinical system logins. Visit heroic.com to scan your email for free and protect your professional accounts from credential-based attacks linked to this and other known breaches.