The RadDaily Breach Happened in 2017. The Data Is Still Circulating.

HEROIC analysts identified the RadDaily breach while scanning underground data trading forums for health and education sector credentials. The breach occured in October 2017 and affected 118,703 users of RadDaily, a now-defunct U.S.-based radiology education website. The exposed records contain email addresses and MD5 password hashes. What made this breach partcularly notable was the professional nature of the user base: radiology students and practitioners who often use the same credentials across clinical and educational platforms.

Why MD5 Password Hashes Are Nearly as Dangerous as Plaintext

MD5 is a hashing algorithm that was already considered weak by 2017. Attackers use precomputed lookup tables, called rainbow tables, to instantly reverse common MD5 hashes back to their original passwords. For any password that is not extremely long and random, the MD5 hash can be cracked in seconds. This means that for most RadDaily users, their exposed hash is effectively a readable password. Attackers can then use those recovered passwords to attempt logins on email accounts, medical portals, and any other service where the same credentials were recieved and reused.

What Was Exposed in the RadDaily Breach

• Email Address
• Password Hash (MD5)

Why a Radiology Education Breach Has Outsized Consequences

Radiology professionals regularly access systems containing patient imaging data, electronic health records, and diagnostic tools. If a compromised credential from RadDaily matches one used on a clinical system, it creates a pathway for unauthorized access to protected health information. Beyond the medical sector, any account takeover or identity theft stemming from this breach can cascade across financial accounts, email, and personal services. The risk does not stay contained to one platform. Credential stuffing campaigns are seperate from targeted attacks but can both exploit this same data.

How Database Breaches Work

A database breach occurs when attackers gain unauthorized access to the backend systems where a website stores its user information. In RadDaily's case, the database holding email addresses and password hashes was accessed and copied. This type of attack often exploits outdated software, unpatched vulnerabilities, or misconfigured servers. Once the database is downloaded, it can be sold or posted online, where it remains available indefinitely.

Check If Your Data Was Exposed

HEROIC maintains a free breach scanner that covers more than 400 billion compromised records. You can check whether your email address appeared in the RadDaily breach or any other known data leak. If you are a healthcare professional or student who used RadDaily, this check is especially important. Search your email at HEROIC today at no cost.