950breaches
17.2Baccounts exposed
8added in 30 days
8.9Maccounts in 30 days
950 results.
20.3M accounts
breached Feb 2021 · added Feb 28, 2021
SuperVPN & GeckoVPN
In February 2021, a series of "free" VPN services were breached including SuperVPN and GeckoVPN, exposing over 20M records. The data appeared together in a single file with a small number of records also included from FlashVPN, suggesting that all three brands may share the same platform. Impacted data also included email addresses, the country logged in from and the date and time each login occurred alongside devic…
Device informationDevice serial numbersEmail addressesGeographic locationsIMSI numbersLogin histories
645.8K accounts
filmai.in · breached Jan 2020 · added Feb 23, 2021
Filmai.in
In approximately 2019 or 2020, the Lithuanian movie streaming service Filmai.in suffered a data breach exposing 645k email addresses, usernames and plain text passwords.
Email addressesPasswordsUsernames
10.6K accounts
nurserycam.co.uk · breached Feb 2021 · added Feb 23, 2021
NurseryCam
In February 2021, a series of egregiously bad security flaws were identified in the NurseryCam system designed for parents to remotely monitor their children whilst attending nursery. The flaws led to the exposure of over 10k parent records before the service was shut down. The email addresses alone were provided to Have I Been Pwned to ensure parents were properly notified of the incident.
Email addresses
358.8K accounts
peoplesenergy.co.uk · breached Dec 2020 · added Feb 23, 2021
People's Energy
In December 2020, the UK power company People's Energy suffered a data breach. The breach exposed almost 7GB of files containing 359k unique email addresses along with names, phones numbers, physical addresses and dates of birth. The incident also included People's Energy staff email addresses and bcrypt password hashes (no customer passwords were exposed).
Dates of birthEmail addressesNamesPasswordsPhone numbersPhysical addresses
1.4M accounts
netgalley.com · breached Dec 2020 · added Feb 23, 2021
NetGalley
In December 2020, the book promotion site NetGalley suffered a data breach. The incident exposed 1.4 million unique email addresses alongside names, usernames, physical and IP addresses, phone numbers, dates of birth and passwords stored as salted SHA-1 hashes.
Dates of birthEmail addressesIP addressesNamesPasswordsPhone numbersPhysical addressesUsernames
110.2K accounts
citybee.lt · breached Feb 2021 · added Feb 17, 2021
CityBee
In February 2021, the Lithuanian car-sharing service CityBee announced they'd suffered a data breach that exposed 110k customers' personal information. The breach exposed names, email addresses, government issued IDs and passwords stored as unsalted SHA-1 hashes.
Email addressesGovernment issued IDsNamesPasswords
2.5M accounts
ge.tt · breached May 2017 · added Feb 16, 2021
Ge.tt
In May 2017, the file sharing platform Ge.tt suffered a data breach. The data was subsequently put up for sale on a dark web marketplace in February 2019 alongside a raft of other breaches. The Ge.tt breach included names, social media profile identifiers, SHA256 password hashes and almost 2.5M unique email addresses.
Email addressesNamesPasswordsSocial media profiles
1M accounts
storybird.com · breached Aug 2015 · added Feb 2, 2021
StoryBird
In August 2015, the storytelling service StoryBird suffered a data breach exposing 4 million records with 1 million unique email addresses. Impacted data also included names, usernames and passwords stored as PBKDF2 hashes. The data was provided to HIBP by dehashed.com.
Email addressesNamesPasswordsUsernames
1.9M accounts
pixlr.com · breached Oct 2020 · added Feb 1, 2021
Pixlr
In October 2020, the online photo editing application Pixlr suffered a data breach exposing 1.9 million subscribers. Impacted data included names, email addresses, social media profiles, the country signed up from and passwords stored as SHA-512 hashes. The data was provided to HIBP by dehashed.com.
Email addressesGeographic locationsNamesPasswordsSocial media profiles
2.8M accounts
bonobos.com · breached Aug 2020 · added Jan 31, 2021
Bonobos
In August 2020, the clothing store Bonobos suffered a data breach that exposed almost 70GB of data containing 2.8 million unique email addresses. The breach also exposed names, physical and IP addresses, phone numbers, order histories and passwords stored as salted SHA-512 hashes, including historical passwords. The breach also exposed partial credit card data including card type, the name on the card, expiry date a…
Email addressesHistorical passwordsIP addressesNamesPartial credit card dataPasswordsPhone numbersPhysical addressesPurchases
77.2M accounts
gonitro.com · breached Sep 2020 · added Jan 19, 2021
Nitro
In September 2020, the Nitro PDF service suffered a massive data breach which exposed over 70 million unique email addresses. The breach also exposed names, bcrypt password hashes and the titles of converted documents. The data was provided to HIBP by dehashed.com.
Email addressesNamesPasswords
19.5M accounts
romwe.com · breached Jun 2018 · added Jan 18, 2021
Romwe
In mid-2018, the Hong Kong-based retailer Romwe suffered a data breach which exposed almost 20 million customers. The data was subsequently sold online and includes names, phone numbers, email and IP addresses, customer geographic locations and passwords stored as salted SHA-1 hashes. The data was provided to HIBP by dehashed.com.
Geographic locationsIP addressesNamesPasswordsPhone numbersPhysical addresses
11M accounts
jobandtalent.com · breached Feb 2018 · added Jan 17, 2021
Jobandtalent
In approximately February 2018, the employment website Jobandtalent suffered a data breach which then appeared for sale alongside other breaches a year later. The incident impacted 11 million subscribers and exposed their names, email and IP addresses and passwords stored as salted SHA-1 hashes.
Email addressesIP addressesNamesPasswords
2.3M accounts
glofox.com · breached Mar 2020 · added Jan 10, 2021
Glofox
In March 2020, the Irish gym management software company Glofox suffered a data breach which exposed 2.3M membership records. The data included email addresses, names, phone numbers, genders, dates of birth and passwords stored as unsalted MD5 hashes.
Dates of birthEmail addressesGendersNamesPasswordsPhone numbers
1.3M accounts
geniusu.com · breached Oct 2020 · added Jan 8, 2021
GeniusU
In November 2020, a collection of data breaches were made public including the "Entrepreneur Success Platform", GeniusU. Dating back to the previous month, the data included 1.3M names, email and IP addresses, genders, links to social media profiles and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
Email addressesGendersIP addressesNamesPasswordsSocial media profiles
1.1M accounts
ledger.com · breached Jun 2020 · added Dec 20, 2020
Ledger
In June 2020, the hardware crypto wallet manufacturer Ledger suffered a data breach that exposed over 1 million email addresses. The data was initially sold before being dumped publicly in December 2020 and included names, physical addresses and phone numbers. The data was provided to HIBP by Alon Gal, CTO of cybercrime intelligence firm Hudson Rock.
Email addressesNamesPhone numbersPhysical addresses
4.2M accounts
peatix.com · breached Jan 2019 · added Dec 6, 2020
Peatix
In January 2019, the event organising platform Peatix suffered a data breach. The incident exposed 4.2M email addresses, names and salted password hashes. The data was provided to HIBP by dehashed.com.
Email addressesNamesPasswords
3.2M accounts
pluto.tv · breached Oct 2018 · added Dec 5, 2020
Pluto TV
In October 2018, the internet television service Pluto TV suffered a data breach which was then shared extensively in hacking communities. Pluto TV "decided not to proactively inform users of the breach" which contained 3.2M unique email and IP addresses, names, usernames, genders, dates of birth and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
Dates of birthDevice informationEmail addressesGendersIP addressesNamesPasswordsSocial media profilesUsernames
226.9M accounts
cit0day.in · breached Nov 2020 · added Nov 19, 2020
Unverified
Cit0day
In November 2020, a collection of more than 23,000 allegedly breached websites known as Cit0day were made available for download on several hacking forums. The data consisted of 226M unique email address alongside password pairs, often represented as both password hashes and the cracked, plain text versions. Independent verification of the data established it contains many legitimate, previously undisclosed breaches…
Email addressesPasswords
8.7M accounts
123rf.com · breached Mar 2020 · added Nov 15, 2020
123RF
In March 2020, the stock photo site 123RF suffered a data breach which impacted over 8 million subscribers and was subsequently sold online. The breach included email, IP and physical addresses, names, phone numbers and passwords stored as MD5 hashes. The data was provided to HIBP by dehashed.com.
Email addressesIP addressesNamesPasswordsPhone numbersPhysical addressesUsernames
8.8M accounts
homechef.com · breached Feb 2020 · added Nov 13, 2020
Home Chef
In early 2020, the food delivery service Home Chef suffered a data breach which was subsequently sold online. The breach exposed the personal information of almost 9 million customers including names, IP addresses, post codes, the last 4 digits of credit card numbers and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
Email addressesGeographic locationsIP addressesNamesPartial credit card dataPasswordsPhone numbers
7.1M accounts
animaljam.com · breached Oct 2020 · added Nov 12, 2020
Animal Jam
In October 2020, the online game for kids Animal Jam suffered a data breach which was subsequently shared through online hacking communities the following month. The data contained 46 million user accounts with over 7 million unique email addresses. Impacted data also included usernames, IP addresses and for some records, dates of birth (sometimes in partial form), physical addresses, parent names and passwords stor…
Dates of birthEmail addressesGendersIP addressesNamesPasswordsPhysical addressesUsernames
1.4M accounts
mashable.com · breached Jun 2020 · added Nov 10, 2020
Mashable
In approximately mid-2020, Mashable suffered a data breach that subsequently turned up publicly in November 2020. The data included 1.4 million unique email addresses along with names, genders, expired auth tokens, physical locations, links to social media profiles and days and months of birth. The data was provided to HIBP by dehashed.com.
Auth tokensEmail addressesGendersGeographic locationsIP addressesNamesPartial dates of birthSocial media profiles
1.1M accounts
redmart.lazada.sg · breached Jul 2020 · added Nov 10, 2020
Lazada RedMart
In October 2020, news broke of Lazada RedMart data breach containing records as recent as July 2020 and being sold via an online marketplace. In all, the data contained 1.1 million customer email addresses alongside names, phone numbers, physical addresses, partial credit card numbers and passwords stored as SHA-1 hashes.
Email addressesNamesPartial credit card dataPasswordsPhone numbersPhysical addresses
1.5M accounts
jamesdelivery.com.br · breached Mar 2020 · added Nov 5, 2020
James
In June 2020, 14 previously undisclosed data breaches appeared for sale including the Brazilian delivery service, "James". The breach occurred in March 2020 and exposed 1.5M unique email addresses, customer locations expressed in longitude and latitude and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
Email addressesGeographic locationsLatitude and longitude pairsPasswords
3.9M accounts
wongnai.com · breached Oct 2020 · added Nov 4, 2020
Wongnai
In October 2020, 17 previously undisclosed data breaches appeared for sale including the Thai restaurant, hotel and attraction finding service, Wongnai. The breach exposed almost 4M unique customer records from some time during 2020 along with names, phone numbers, links to social media profiles and passwords stored as MD5 hashes. The data was self-submitted to HIBP by Wongnai.
Dates of birthEmail addressesGeographic locationsIP addressesNamesPasswordsPhone numbersSocial media profiles
4.4M accounts
minted.com · breached May 2020 · added Nov 3, 2020
Minted
In May 2020, the online marketplace for independent artists Minted suffered a data breach that exposed 4.4M unique customer records subsequently sold on a dark web marketplace. Exposed data also included names, physical addresses, phone numbers and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
Email addressesNamesPasswordsPhone numbersPhysical addresses
1.3M accounts
promofarma.com · breached Aug 2019 · added Nov 1, 2020
Promofarma
In August 2019, a data breach from the Spanish online pharmacy Promofarma appeared for sale on a dark web marketplace. The breach exposed over 2.7M records and contained almost 1.3M unique customer email addresses. The data also included customer names and was provided to HIBP by dehashed.com.
Email addressesNames
2.2M accounts
startribune.com · breached Oct 2019 · added Oct 30, 2020
StarTribune
In October 2019, the Minnesota-based news service StarTribune suffered a data breach which was subsequently sold on the dark web. The breach exposed over 2 million unique email addresses alongside names, usernames, physical addresses, dates of birth, genders and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
Dates of birthEmail addressesGendersNamesPasswordsPhysical addressesUsernames
616.1K accounts
reincubate.com · breached May 2017 · added Oct 29, 2020
Reincubate
In October 2020, the app data company Reincubate suffered a data breach which exposed a backup from November 2017 (the newest record in the data appeared several months earlier). The data included over 616k unique email addresses, names and passwords stored as PBKDF2 hashes.
Email addressesNamesPasswords
Breach data from Have I Been Pwned. Breaches HIBP marks as sensitive are not listed.