Pharmacie.ma: customer database leaked on DarkForums

Overview

On September 29, 2025, DarkForums user KaruHunters published what he describes as the full customer database of Pharmacie.ma, a Moroccan online portal for pharmacy and medicine information. The post claims 41,772 customer records were exported and includes the SQL table schema plus sample rows from the clients table. KaruHunters is a well-known forum member holding GOD, Hacker and Leaker awards.

What was published

The leaked database schema and samples show the following fields per customer:

• Email address and password hash
• First name, last name and salutation
• Phone and mobile numbers
• Professional address and city
• Pharmacy name, occupation and specialty
• Year of diploma and birthdate
• Newsletter and account status flags

A second DarkForums thread later shared the same database as a 33 MB SQL dump.

Risks for affected individuals

Moroccan pharmacists, pharmacy students and health professionals registered on the portal could be exposed to credential stuffing, phishing and targeted scams if they reused passwords. The combination of personal and professional details increases the risk of convincing social engineering.

What remains unknown

• Pharmacie.ma has not publicly confirmed the breach
• The password hashes have not been publicly cracked
• The exact age of the records is unclear, with sample entries dating to 2014

What affected people should do

Anyone who had an account on Pharmacie.ma should change the password on that site and on any other service using the same credentials. Enabling two-factor authentication and watching for phishing emails addressed to their professional role is recommended.