Pharmacie.ma (Morocco): customer database leak

Overview

On 29 September 2025, DarkForums.ru user KaruHunters posted a thread claiming a data breach of Pharmacie.ma, an online information portal for pharmacy and medicine in Morocco. The poster states that 41,772 customer records were exported from the platform.

Exposed data

The thread includes a partial SQL dump showing the table schema and sample rows. The exposed columns include:

• Email addresses and password hashes
• First and last names, salutation and activity type
• Pharmacy name, professional address and city
• Phone and mobile numbers, country and birthdate
• Activation and password reset keys

Sample rows show records from 2014 onwards, with entries for pharmacists, doctors and pharmacy students based in Morocco and a few other countries.

Credibility

The posting account KaruHunters holds GOD, Hacker and Leaker awards on DarkForums.ru and joined in August 2024. UpGuard reported the alleged breach of Pharmacie.ma in January 2026 based on dark web monitoring, which aligns with the forum claim.

What remains unknown

The full dump has not been reviewed, so the exact number of affected records is unverified. It is unclear whether the password hashes can be reversed and whether the portal has notified affected users. The intrusion method is not described.

Advice for affected people

Users of Pharmacie.ma should treat their email address and password as exposed. Passwords should be changed on the portal and on any other service where the same combination was reused. Phishing attempts that reference pharmacy services should be treated with caution.