9,302 Passwords From the Pharmgeocom Leak Just Surfaced Online

HEROIC analysts identified a dataset tied to Pharmgeocom (Фармгеоком), a major Russian supplier and online store for dental and medical products, circulating on a Telegram channel. The data is dated February 9, 2025, and contains 9,302 records made up of email addresses, phone numbers, MD5 password hashes, first names, and last names. Pharmgeocom has not confirmed this incident, so it should be treated as an unverified leak rather than a company statement.

Why a Medical Supplier's Customer Data Is High-Value to Attackers

This is not a simple email list. Whoever assembled this dataset has a customer's real name, phone number, email address, and a password hash all tied together, information sourced from a business that sells dental and medical supplies. That combination gives attackers everything needed to run convincing, personalized scams, and the sector itself adds an extra layer of concern since customers of medical suppliers are often specifically targeted for health-related fraud and phishing.

What Was Exposed in the Pharmgeocom Leak

• Email addresses
• Phone numbers
• Password hashes (MD5 format)
• First names
• Last names

Why This Matters Beyond a Single Account

MD5 password hashes are fast and inexpensive to crack using tools that are freely available. Once an attacker recovers the plaintext password, they combine it with the matching email and try it across other services, a technique called credential stuffing. Add a real name and phone number into the mix and the same data fuels convincing phishing emails and SIM-swapping attempts, where an attacker tries to hijack a victim's phone number to intercept security codes for other accounts.

How a Database Leak Like This Reaches Telegram

This incident is classified as a database leak, meaning an attacker gained direct access to Pharmgeocom's backend customer records, likely through a software vulnerability or compromised credentials, rather than targeting individual shoppers one at a time. Instead of a traditional hacking forum, the dataset surfaced on a Telegram channel, a distribution method that has become increasingly popular for sharing stolen data quickly and with minimal oversight. Once a customer database is exported in full like this, it tends to be copied and re-shared repeatedly across other channels and forums.

Check If Your Data Was in the Pharmgeocom Leak

The only way to know for certain if your information appears in this leak, or any of the thousands of others HEROIC monitors, is to check directly. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including this one, and tells you instantly if you need to take action. If you get a match, change that password everywhere you reused it and stay alert for unexpected calls, texts, or emails referencing your account.