133,724 Mental Health Records From We.Care Exposed on the Dark Web

In December 2024, We.Care, a Danish online mental health consultation platform, suffered a database breach that exposed the personal data of 133,724 individuals. The compromised records include highly sensitive health-adjacent information stored alongside plaintext passwords, creating an immediate and ongoing threat to affected users. For a platform serving people seeking mental health support, the exposure of this data carries consequences far beyond a typical credential leak.

Why This Is Dangerous

Mental health platforms collect deeply personal information about users in vulnerable situations. When that data is combined with plaintext passwords and identifying details like birthdays and phone numbers, attackers gain everything they need to impersonate victims, access their other accounts, and target them with highly personalized phishing messages. The plaintext password storage is a fundamental security failure that makes exploitation immediate, requiring no cracking effort.

What Was Exposed

The We.Care breach exposed the following data types for up to 133,724 individuals:

• Email Address
• Phone Number
• Plaintext Password
• First Name
• Last Name
• Gender
• Birthday

Why This Matters

The combination of personal identifiers and plaintext passwords creates a compounding chain of risk:

• Credential stuffing: Plaintext passwords can be tested against email, banking, and social media accounts immediately, with no cracking required.
• Account takeover: Attackers who match an email and password can lock users out of their own accounts across multiple services.
• Identity theft: Full names, birthdays, phone numbers, and gender provide the core data set for opening fraudulent accounts or passing identity verification checks.
• Targeted phishing: Knowing a user sought mental health services gives attackers a powerful social engineering angle for highly personalized scams.
• Fraud: Phone numbers enable SIM-swapping attacks, bypassing SMS-based two-factor authentication.

How Database Breaches Work

Database breaches typically occur when attackers exploit unpatched vulnerabilities in web applications, gain access through compromised administrative credentials, or abuse misconfigured database servers exposed to the internet. Once inside, attackers can export entire tables of user data within minutes. In the We.Care incident, the data appears to have been exfiltrated directly from the platform's user database and subsequently distributed on dark web marketplaces. The storage of passwords in plaintext, rather than using modern hashing algorithms like bcrypt or Argon2, represents a severe and preventable security failure under both best practice guidelines and Danish data protection regulations.

Check If You Are Affected

If you have ever created an account on We.Care, your personal data and password may be in the hands of threat actors right now. Heroic's breach search tool indexes over 400 billion compromised records, giving you instant visibility into whether your email address appears in known breach data sets including this one.

Search your email address now at Heroic to find out if your credentials were exposed in the We.Care breach or any other known data leak.