HEROIC Finds Ohio Academy of Family Physicians Breach: 16,777 Exposed

HEROIC's DarkHive intelligence system discovered the Ohio Academy of Family Physicians data breach, exposing 16,777 records from a trusted professional medical organization. The breach occured in March 2018, leaking email addresses and password hashes from physicians, healthcare administrators, and medical professionals who used the organization's membership portal.

Why This Is Dangerous

Healthcare professional organizations hold contact information for licensed practitioners with access to patient records, prescription systems, and hospital networks. Attackers who obtain verified physician email addresses can launch highly targeted spear-phishing campaigns that exploit the trusted reputation of the OAFP brand. Cracked password hashes then enable direct credential stuffing against medical licensing portals, hospital login systems, and electronic health record platforms, where a single compromised account can expose thousands of patient records.

What Was Exposed

• Email Address
• Password Hash (phpass)

Why This Matters

The phpass hashing algorithm used in this breach is outdated and considerably weaker than modern alternatives like bcrypt or Argon2. Many phpass hashes can be cracked through dictionary attacks or rainbow table lookups, converting stored hashes into usable plaintext passwords quickly. Medical professionals who reused thier OAFP portal credentials on hospital systems, telehealth platforms, or insurance portals face serious account takeover risk, with downstream consequences including fraud, identity theft, and unauthorized access to protected health information.

How Database Leaks Work

Database leaks at professional organizations often stem from outdated web platforms that run on legacy content management systems with unpatched security vulnerabilities. Attackers identify exposed login endpoints, exploit insecure database queries, or use stolen administrator credentials to access user tables. Once extracted, the data circulates in combolists on underground forums and encrypted messaging channels, where it is recombined with other breach data to maximize coverage.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like the Ohio Academy of Family Physicians. Visit heroic.com to scan your email address and find out if your information was exposed.