PoradnikZdrowie Data Breach
The 2019 PoradnikZdrowie data breach occurred in November 2019 when the vBulletin discussion forum (forum.poradnikzdrowie.pl) of PoradnikZdrowie (poradnikzdrowie.pl), one of Poland's most prominent digital health, medical advice, and wellness publications, was breached via exploitation of the CVE-2019-16759 unauthenticated remote code execution vulnerability.
Exposed Data Types
4- Email addresses
- Usernames
- Passwords
- IP addresses
About This Breach
What information was affected in the PoradnikZdrowie incident?
The leaked forum user table (forum.poradnikzdrowie.pl._november2019_vB_87879.csv) comprises registered community members seeking and discussing medical counsel. The breach compromised records for 43,862 unique members, exposing:
- Account Identifiers: Discussion forum usernames.
- Contact Credentials: Canonical email addresses across Polish domestic mail services (wp.pl, o2.pl, onet.pl, interia.pl) and global providers.
- Authentication Secrets: Salted MD5 password hashes and per-user cryptographic salts.
- Network Telemetry: Logged client IP addresses.
How many accounts were affected?
Rigorous RFC canonical parsing and deduplication confirmed 43,862 unique valid email addresses across 87,879 total forum records.
Technical analysis and security risks
Exploitation of CVE-2019-16759 granted attackers full database read access without prior privileges. Correlating forum participation on sensitive medical questions with real-world email addresses and IP logs poses high risks of privacy violations, targeted extortion, and credential reuse attacks.
Recommended actions for affected users
Users who held an account on PoradnikZdrowie forum should:
- Immediately change passwords across any email or personal accounts where their forum password was shared.
- Adopt a password manager to generate distinct credentials for health and discussion forums.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
