SuperBetter Data Breach: 34,043 Health Records Exposed

When a Wellness App Becomes a Security Liability

SuperBetter built its reputation on turning helath challenges into games -- but in May 2017, the platform itself became a vulnerability. A database breach exposed 34,043 user accounts, and the damage was compounded by one catastrophic decision: passwords were stored in plaintext. That means every compromized credential was immediately readable, with no hashing or encryption standing between attackers and user accounts.

SuperBetter (May 2017): Breach Summary

• Records Exposed: 34,043
• Data Types: Email addresses, plaintext passwords
• Breach Type: Database breach
• Password Type: Plaintext -- highest possible risk; credentials immediately usable for account takeover without any cracking required
• Country: USA
• Date Leaked: May 22, 2017

The Plaintext Problem: Why This Breach Is Still Dangerous in 2026

Plaintext password storage is widely considered the most egregious failure in credentails security. Unlike MD5 or bcrypt hashes -- which at least require cracking effort -- plaintext means the password is stored exactly as the user typed it. Any attacker who accessed SuperBetter's database had instant, ready-to-use credentials for 34,043 accounts. No rainbow tables, no cracking rigs, no GPU clusters required.

Breaches this old rarely disappear from the internet. SuperBetter's 2017 data has cycled through credential markets for years, appearing in combolists used for large-scale stuffing operations. Any user who set their SuperBetter password as their email password, banking password, or healthcare portal password in 2017 -- and never changed it -- remains at risk today.

Health App Users: A High-Value Target for Credential Stuffing

SuperBetter isn't a social media platform or an ecommerce site -- it's a gamified wellness and mental health application. Its user base skews toward individuals actively managing chronic illness, mental health conditions, ADHD, anxiety, and physical recovery. This demographic often uses the same email-and-password combination across multiple platforms, including telehealth portals, insurance logins, and prescription management apps.

That pattern makes the SuperBetter breach particularly dangerous. Attackers running stuffing campaigns against healthcare platforms -- where full medical records, insurance details, and prescription histories are stored -- will prioritize credential lists tied to health app users. A 34,000-record database of verified health-app email/password pairs is a high-value commodity in any credential market.

Why 2017 Breaches Still Generate Active Fraud in 2026

Credential reuse is persistent. Research consistently shows that a large percentage of users maintain the same password across platforms for years, sometimes decades. Breach data from 2017 continues to generate successful account takeovers in 2026 precisely because the humans on the other end of those accounts haven't changed their passwords.

SuperBetter's exposed data has had nearly a decade to circulate, be aggregated into combolists, and be tested against virtually every major platform on the internet. Users who have not audited their accounts since 2017 -- especially any health, wellness, or medical platform accounts -- face ongoing exposure.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records, including historical health app breaches like SuperBetter. Enter your email to see if your credentials are circulating in active combolists -- and take action before someone else does.