Our Analysts Found the Scharlab Breach Circulating on Underground Forums

HEROIC analysts discovered a dataset tied to Scharlab, a Spain-based laboratory chemicals and equipment supplier, circulating on underground hacking forums in August 2018. The breach affected 24,781 users and exposed email addresses alongside country data. While no passwords were included in this particular dataset, the exposed email addresses are highly valuable to attackers who build targeted phishing campaigns and cross-reference multiple breach sources to create detailed profiles on potential victims. The Scharlab user base -- professionals in medical, research, and laboratory fields -- represents a particularly high-value target for spear-phishing and business email compromise attacks.

Why This Is Dangerous

Email addresses exposed in a breach like Scharlab do not need to include passwords to be dangerous. Attackers who recieve a list of verified, active email addresses from a professional supplier can immediately begin crafting targeted phishing messages. For professionals in medical and laboratory environments, a convincing phishing email impersonating a supplier, regulator, or research institution can lead to credential theft, network intrusion, or data exfiltration. The country data included in this breach also helps attackers localize and tailor their attacks to specific regions and languages.

What Was Exposed

• Email Address
• Country

Why This Matters

Professional email addresses from medical and scientific suppliers are prime targets for business email compromise and spear-phishing. Even without passwords, the Scharlab dataset enables attackers to build highly credible impersonation campaigns. When this data is cross-referenced with other breached datasets -- a common practice in the threat actor community -- attackers can construct complete profiles that include passwords, phone numbers, and physical addresses. Credential stuffing, identity theft, and targeted fraud are all realistic downstream consequences for anyone whose email appeared in this breach.

How a Database Breach Works

A database breach occured when an attacker gains unauthorized access to the backend systems of a website or application. In Scharlab's case, the exposed data appears to have been exfiltrated directly from the platform's user database, which stored account registration details including email addresses and the geographic origin of each user. Once exfiltrated, this data was shared on underground forums where it was downloaded by multiple threat actors and incorporated into larger combolists. Even datasets that lack passwords are actively traded and used, as they provide verified contact information for future attacks.

Check If You Are Affected

HEROIC's free scanner searches across more than 400 billion breached records, including this Scharlab dataset. If you registered an account with Scharlab or used your professional email address on their platform, your address may be circulating in threat actor databases right now. Run a seperate check for each email you use -- the scan is free, takes just seconds, and will show you every known breach where your email has appeard, giving you a clear picture of your current exposure.