2,500 NMP Pharmacy Accounts Leaked: Hashed Passwords Exposed

HEROIC analysts identified a database leak tied to NMP Pharmacy, a Pakistani pharmaceutical company, after it surfaced on a hacking forum on June 23, 2024. The exposed data covers 2,500 records and includes customer names, contact details, and password hashes tied to NMP accounts.

Why This Is Dangerous

The leak pairs full names and contact information with password hashes, which is enough for an attacker to build a convincing profile of each victim. Even hashed with bcrypt, passwords can still be cracked offline, especially if the original password was short or commonly used. Combined with a name, email, and phone number, that cracked password becomes a direct key into other accounts the same person owns.

What Was Exposed

• Email addresses
• Phone numbers
• First and last names
• Password hashes (bcrypt)

Why This Matters

Health-related accounts are attractive targets because they connect real identities to real contact information, which criminals use for phishing emails and text messages that look like they come from a trusted pharmacy or clinic. If any of the 2,500 affected people reused their NMP password elsewhere, an attacker who cracks the hash could attempt to log into email, banking, or shopping accounts using the same credentials, a technique known as credential stuffing.

How Database Breaches Happen

This incident is classified as a database breach, meaning an attacker likely gained direct access to NMP Pharmacy's backend systems rather than harvesting data from individual devices. Common causes include SQL injection vulnerabilities, exposed database backups, or stolen administrator credentials. Once inside, an attacker can export entire tables of customer records in minutes, which is why the leaked file contains structured fields like names, phone numbers, and hashed passwords rather than a random mix of stolen files.

Check If You Are Affected

If you have ever used NMP Pharmacy's website or ordered through their platform, it is worth checking whether your information appears in this leak. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to tell you instantly if your email address has been exposed, and what data was attached to it.