The Therapy Tools Dump Contains 14,789 Exposed Email Records

In August 2018, HEROIC found 14,789 email addresses and plaintext passwords from Therapy Tools exposed on a prominent hacking forum. The data came from a now-defunct U.S. e-commerce platform that provided resources for speech, occupational, and physical therapists.

Why the Therapy Tools Breach Is Dangerous

Plaintext passwords require no cracking. Anyone who downloaded this dataset can immediately attempt to log into other accounts using each exposed email and password pair. Therapists who reused credentials may have exposed client management systems, insurance portals, healthcare databases, or professional email accounts tied to the same password.

What Was Exposed in the Therapy Tools Leak

• Email addresses
• Plaintext passwords

Why This Therapy Tools Data Puts You at Risk

With plaintext passwords in hand, attackers run automated credential stuffing attacks against any platform where the same email and password were used. For healthcare professionals, that risk extends to systems holding patient records, billing data, and insurance information. Identity theft and professional account takeover are the primary concerns for anyone whose credentials appeared in this dataset.

How a Database Breach Works

A database breach occurs when an attacker extracts records from an organization's user database, often through SQL injection or compromised admin access. Storing passwords in plaintext, as Therapy Tools did, means every extracted record gives attackers immediately usable credentials. Those records then circulate on hacking forums for years, used in ongoing credential stuffing campaigns long after the initial breach.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or credentials appeared in the Therapy Tools leak or thousands of other breaches in our database.