950breaches
17.2Baccounts exposed
8added in 30 days
8.9Maccounts in 30 days
950 results.
70.4K accounts
lassuranceretraite.fr · breached Sep 2024 · added Oct 20, 2026
Assurance Retraite
In September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries. The data included 70k unique email addresses along with names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers (NIR) and contact details of relatives or other nominated contacts. In its disclosure notice…
Dates of birthEmail addressesFamily members' namesGovernment issued IDsIncome levelsMarital statusesNamesPhone numbersPhysical addresses
117.6K accounts
gites-de-france.com · breached May 2026 · added Oct 18, 2026
Gîtes de France
In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, including 118k unique email addresses alongside names, phone numbers, postal addresses and booking details.
Booking detailsEmail addressesNamesPhone numbersPhysical addresses
559.9K accounts
crunchbase.com · breached Jan 2026 · added Oct 14, 2026
Crunchbase
In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters "pay or leak" extortion attempt. Data allegedly obtained from the company was subsequently published publicly and included 560k unique email addresses, largely belonging to leads and business contacts. Other data included names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. Crunchbas…
Email addressesEmployersJob titlesNamesPhone numbersPhysical addressesSocial media profiles
318.2K accounts
sharecare.com · breached Aug 2026 · added Oct 12, 2026
Sharecare
In August 2026, the digital health company Sharecare was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers. The data also included a small number o…
Dates of birthEmail addressesEmployersGendersGovernment issued IDsJob titlesMarital statusesNamesPhone numbersPhysical addresses
436K accounts
neogen.com · breached Aug 2026 · added Oct 9, 2026
Neogen
In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters "pay or leak" extortion attempt. The group later published data it claimed had been obtained from Neogen. The data consisted largely of corporate contact records and included 436k unique email addresses from mailing lists, employee records and other contacts.
Email addressesEmployersJob titlesNamesPhone numbersPhysical addressesSalutations
373.5K accounts
cyrusone.com · breached Aug 2026 · added Oct 7, 2026
CyrusOne
In August 2026, data centre operator CyrusOne was the target of a ShinyHunters "pay or leak" extortion attempt. The group subsequently published data allegedly obtained from the company, which included 373k unique email addresses across records relating to users, sales leads and CyrusOne employees. The data largely consisted of corporate contact information, including names, physical addresses, phone numbers and job…
Email addressesEmployersJob titlesNamesPhone numbersPhysical addressesSupport tickets
274.9K accounts
doublecounter.gg · breached Oct 2026 · added Oct 7, 2026
Double Counter
In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool. In its disclosure notice, Double Counter advised that attackers gained access to a subset of its data. A corpus of data was subsequently published publicly and contained 275k unique email addresses and Discord usernames. A small number of records belonging to payi…
Email addressesGeographic locationsNamesUsernames
6.8M accounts
angelone.in · breached Apr 2023 · added Oct 7, 2026
Angel One
In July 2024, the Indian stock brokerage firm Angel One confirmed that data leaked online related to a breach that occurred in April 2023. The leaked data included 7.9M user records containing 6.8M unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs) and portfolio holdings. Angel One emphasised that the breach "has no impact on client sec…
Bank account numbersDates of birthEmail addressesFinancial investmentsGovernment issued IDsNamesPhone numbersPhysical addresses
17.8M accounts
limeleads.com · breached Aug 2019 · added Sep 22, 2026
LimeLeads
In 2019, the now-defunct B2B marketing leads database service LimeLeads suffered a data breach due to an exposed, unsecured Elasticsearch server. The incident exposed tens of millions of records of largely corporate contact data containing 17.8M unique email addresses, along with phone numbers, employers, job titles and geographic locations including state, city and postcode.
Email addressesEmployersGeographic locationsJob titlesPhone numbers
3.2M accounts
burgerkingrus.ru · breached Aug 2024 · added Sep 21, 2026
Burger King Russia
In October 2024, news of a data breach exposing Burger King Russia customers broke following an August attack on the Mindbox marketing automation platform. The breach exposed 3.2M unique email addresses along with names, genders, dates of birth, phone numbers and approximate geolocations, with the data spanning 2018 to August 2024. Burger King Russia acknowledged the incident and advised it did not include payment o…
Dates of birthEmail addressesGendersGeographic locationsNamesPhone numbers
4.7M accounts
chess.com · breached Aug 2026 · added Sep 13, 2026
Chess.com (2026)
In August 2026, millions of records allegedly sourced from Chess.com were posted online. The data contained 7.3M rows with 4.6M unique email addresses, along with usernames, names, countries and data relating to users' Chess.com accounts. Analysis of the data suggested it had been obtained by scraping. When loaded into HIBP, 99% of the email addresses had already appeared in previous data breaches, further supportin…
Email addressesGeographic locationsNamesUsernames
8.8M accounts
magairports.com · breached Aug 2026 · added Sep 2, 2026
Manchester Airports Group
In August 2026, Manchester Airports Group (MAG) disclosed a data breach impacting their services. The incident was later claimed by the FulcrumSec hacking group, who subsequently published email addresses and phone numbers relating to 8.8M customers of Manchester, Stansted and East Midlands airports. The data contained personal information relating to airport services, including vehicle registrations and parking his…
Browser user agent detailsEmail addressesGeographic locationsIP addressesNamesPhone numbersPurchasesVehicle registration plates
1.2M accounts
questel.com · breached Aug 2026 · added Sep 1, 2026
Questel
In August 2026, the French intellectual property software and services company Questel was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published an extensive corpus of data they alleged was obtained from the company, largely comprising corporate contact information associated with sales leads, support cases and marketing activities, with 1.2M unique email addresses. The data…
Email addressesEmployersJob titlesNamesPhone numbersPhysical addressesSupport tickets
12.9M accounts
carhartt.com · breached Aug 2026 · added Aug 25, 2026
Carhartt
In August 2026, clothing retailer Carhartt was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly obtained from the company including 12.9M unique email addresses, names, phone numbers and physical addresses. The published corpus also contained millions of synthetic records that did not relate to real individuals and were excluded from the breach.
Email addressesNamesPhone numbersPhysical addresses
569K accounts
golfcanada.ca · breached May 2026 · added Aug 22, 2026
Golf Canada
In mid-2026, hundreds of thousands of user records allegedly sourced from Golf Canada began circulating via Telegram. The data included 569k unique email addresses along with names, usernames, dates of birth, genders and approximate geographic locations (city, province and postcode). It remains unclear whether the data was obtained via unintentionally exposed website features or a security vulnerability.
Dates of birthEmail addressesGendersGeographic locationsNamesUsernames
2M accounts
ozhairandbeauty.com · breached Aug 2026 · added Aug 19, 2026
Oz Hair and Beauty
In August 2026, Australian beauty retailer Oz Hair and Beauty was the target of an xpl0itrs extortion attack. The group subsequently published data allegedly obtained from the company, which included 2M unique email addresses along with names, phone numbers, geographic locations (suburb and postcode) and purchases.
Email addressesGeographic locationsNamesPhone numbersPurchases
144.5K accounts
fanlore.org · breached Aug 2026 · added Aug 19, 2026
Fanlore
In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates. The breach resulted in the exposure of 145k unique email addresses along with usernames and passwords stored as either MD5 or PBKDF2 hashes. OTW self-submitted the exposed data to HIBP.
Email addressesNamesPasswordsUsernames
1.6M accounts
ringcentral.com · breached Jul 2026 · added Aug 13, 2026
RingCentral
In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they claimed was obtained from the platform, which included 1.6M unique email addresses along with names, physical addresses and phone numbers. In their disclosure notice, RingCentral advised that the incident affected "a limited portion o…
Email addressesNamesPhone numbersPhysical addresses
218.4K accounts
alcon.com · breached Aug 2026 · added Aug 9, 2026
Alcon
In August 2026, the Alcon eye care company was named in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly sourced from Alcon containing 218k unique email addresses along with other largely corporate B2B contact fields, including name, phone number and physical address.
Email addressesNamesPhone numbersPhysical addresses
732.2K accounts
brinkshome.com · breached Jul 2026 · added Aug 8, 2026
Brinks Home
In July 2026, Brinks Home was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they alleged was taken from the company, including 732k unique email addresses and other personal information relating to leads, customers and Brinks staff such as name, phone numbers and physical addresses. The data also included purchases from Brinks along with partial credit card data (…
Dates of birthEmail addressesNamesPartial credit card dataPhone numbersPhysical addressesPurchases
276.1K accounts
icsecurity.com · breached Jun 2026 · added Aug 5, 2026
Inter-Con Security
In June 2026, Inter-Con Security was targeted in a ShinyHunters “pay or leak” extortion campaign. The group subsequently published data it alleged was taken from the company, including 276k unique email addresses along with names, physical addresses, job titles and phone numbers. The data encompassed a combination of contacts, internal users and leads.
Email addressesEmployersJob titlesNamesPhone numbersPhysical addresses
865.3K accounts
splitvpn.io · breached Jul 2026 · added Aug 1, 2026
SplitVPN
In July 2026, the Russian VPN service SplitVPN (previously known as NotVPN) suffered a data breach. The incident exposed millions of customer records, including 865k unique email addresses. Other impacted data included IP addresses, the user's country, and partial payment card data (first 6 and last 4 digits plus expiry date).
Device informationEmail addressesGeographic locationsIP addressesPartial credit card data
831.6K accounts
hccs.edu · breached Jun 2026 · added Jul 28, 2026
Houston City College
In June 2026, Houston City College was the target of a ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from the college was later published publicly and included 832k unique email addresses along with names, addresses, phone numbers, academic records, and other personal information relating to both current students and alumni.
Academic recordsCitizenship statusesDates of birthEmail addressesGendersNamesPhone numbersPhysical addresses
55.3M accounts
suno.com · breached Nov 2025 · added Jul 20, 2026
Suno
In November 2025, AI music generation tool Suno suffered a data breach that later came to light in July the following year. The data contained over 55M unique email addresses. Phone numbers were also present where they had been used as the sign-up method. Although representing a small portion of the corpus, the breach also included tens of thousands of Stripe records relating to purchases, containing names, physical…
Email addressesNamesPartial credit card dataPhone numbersPhysical addressesPurchases
23.3M accounts
paidwork.com · breached Mar 2026 · added Jul 19, 2026
Paidwork
In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale. Almost 11GB of data allegedly obtained from the platform was subsequently posted publicly in July and contained over 23M unique email addresses. The breach also included a broad range of other data relating to the operation of the platform including user profile data, banking information, pay…
Bank account numbersDates of birthDevice informationEducation levelsEmail addressesFinancial transactionsGendersIP addressesNamesPasswordsPersonal interestsPhone numbersPhysical addressesProfile photos
821.1K accounts
fluke.com · breached Jul 2026 · added Jul 15, 2026
Fluke
In July 2026, electronic test and measurement equipment company Fluke was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published more than 100GB of data allegedly taken from the company. The corpus contained largely corporate contact information, including over 800k unique email addresses, names, phone numbers and physical addresses. A large collection of support cases was also…
Email addressesEmployersJob titlesNamesPhysical addressesSupport tickets
6.6M accounts
goosecreek.com · breached Jun 2026 · added Jul 15, 2026
Goose Creek
In June 2026, a party claiming to have access to data from Goose Creek Candle Company sent emails to a number of the company's customers, claiming the company had a security vulnerability and suffered a data breach. The data was subsequently sent to Have I Been Pwned and contained 6.6M unique email addresses along with names, phone numbers, physical addresses, order IDs and total spent. The data appears to have been…
Email addressesNamesPhone numbersPhysical addressesPurchases
793.9K accounts
glendale.edu · breached Jun 2026 · added Jul 11, 2026
Glendale Community College
In June 2026, Glendale Community College was the target of a ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from Glendale was later published online and included almost 800k unique email addresses along with various other data fields, including names, addresses, phone numbers, Social Security numbers and other information relating to student enrolments. In its disclosure notice, the college a…
Academic recordsDates of birthEmail addressesGendersGovernment issued IDsNamesPhone numbersPhysical addresses
2.3M accounts
moody.edu · breached Jun 2026 · added Jul 3, 2026
Moody Bible Institute
In June 2026, Moody Bible Institute was targeted by a ShinyHunters "pay or leak" extortion campaign. Over 2.3M unique email addresses and other personal data were later published publicly, including names, physical addresses, phone numbers, dates of birth and other information relating to donors, supporters, students and alumni. In their disclosure notice, Moody advised that they had "engaged both internal and exter…
Dates of birthEmail addressesGendersMarital statusesNamesPhone numbersPhysical addresses
2.7M accounts
sysco.com · breached Jun 2026 · added Jun 28, 2026
Sysco
In June 2026, the food distribution company Sysco was targeted by a ShinyHunters "pay or leak" extortion campaign. Data was subsequently published containing 2.7M unique email addresses belonging to staff and customers. The data also contained largely corporate contact information including names, phone numbers, physical addresses, internal job titles, and customer feedback.
Customer feedbackEmail addressesEmployersJob titlesNamesPhone numbersPhysical addressesUsernames
Breach data from Have I Been Pwned. Breaches HIBP marks as sensitive are not listed.