Skip to content

H1 Data Breach: 2M+ Medical Professional Records Leaked

Breach Report United States flagUnited States Healthcare

H1.co Data Breach: 2M+ Medical Professional Records Leaked

A threat actor using the alias Soral claims to have breached H1 (h1.co), a global healthcare technology and data-analytics company. The post advertises a dataset of 2,064,071 medical professionals, reportedly including IDs, full names, civility, sex, country, specialties, diploma and license names, years of experience, and photos. The sample records are largely French healthcare practitioners drawn from professional registry data. No patient data, contact details, or credentials appear in the listed fields. The claim is unverified and H1 has not publicly addressed it.

Data2M+ professionals
PriceFree leak
CountryUnited States flagUnited States
ActorSoral

Post details

TargetH1 (h1.co), healthcare data analytics
CountryUnited States flagUnited States
SectorHealthcare Tech / Data Analytics
ClaimMedical-professional database breached
Data2,064,071 professional records
ObservedJun 10, 2026
PriceFree leak (reply-gated)
ActorSoral (GOD user)

!Allegedly exposed

  • 2,064,071 professional records (claimed)
  • Full names & civility
  • Sex & country
  • Medical specialties
  • Diploma & license names
  • Years of experience
  • Workplace names & sector
  • Profile photos

Screenshot

Potential impact

If genuine, a directory of 2 million+ medical professionals with names, specialties, qualifications, workplaces, and photos would be a useful targeting resource for phishing and impersonation aimed at the healthcare sector. The per-record sensitivity is lower than a patient or consumer breach: the listed fields are professional and contain no patient data, contact details, or credentials, and much of the data appears derived from public professional registries (such as France's RPPS). The main risk comes from scale and aggregation rather than individually secret information. Figures and authenticity are unconfirmed.

iStatus

Unverified

Sample records and field listings were posted to an underground forum, with the full dataset behind a reply gate; the sample records and download links are not reproduced here. The claim has not been independently confirmed and H1 has not publicly addressed it.

Want the non-redacted screenshots? Paid subscribers get all of the claim details and unredacted screenshots. Check out the threat feed or ransomware feed (whichever applies to this post), then after subscribing, search there for this alert to view the unredacted version. View pricing →

DARK WEB INFORMER - THREAT INTELLIGENCE

Latest