950breaches
17.2Baccounts exposed
8added in 30 days
8.9Maccounts in 30 days
950 results.
26.4M accounts
livejournal.com · breached Jan 2017 · added May 26, 2020
LiveJournal
In mid-2019, news broke of an alleged LiveJournal data breach. This followed multiple reports of credential abuse against Dreamwidth beginning in 2018, a fork of LiveJournal with a significant crossover in user base. The breach allegedly dates back to 2017 and contains 26M unique usernames and email addresses (both of which have been confirmed to exist on LiveJournal) alongside plain text passwords. An archive of th…
Email addressesPasswordsUsernames
990.9K accounts
petflow.com · breached Dec 2017 · added May 26, 2020
PetFlow
In December 2017, the pet care delivery service PetFlow suffered a data breach which consequently appeared for sale on a dark web marketplace. Almost 1M accounts were impacted and exposed email addresses and passwords stored as unsalted MD5 hashes.
Email addressesPasswords
1.1M accounts
artsy.net · breached Apr 2018 · added May 25, 2020
Artsy
In April 2018, the online arts database Artsy suffered a data breach which consequently appeared for sale on a dark web marketplace. Over 1M accounts were impacted and included IP and email addresses, names and passwords stored as salted SHA-512 hashes.
Email addressesIP addressesNamesPasswords
3.7M accounts
lifebear.com · breached Feb 2019 · added May 25, 2020
Lifebear
In early 2019, the Japanese schedule app Lifebear appeared for sale on a dark web marketplace amongst a raft of other hacked websites. The breach exposed almost 3.7M unique email addresses, usernames and passwords stored as salted MD5 hashes.
Email addressesPasswordsUsernames
43.5K accounts
nulled.ch · breached May 2020 · added May 24, 2020
Nulled.ch
In May 2020, the hacking forum Nulled.ch was breached and the data published to a rival hacking forum. Over 43k records were compromised and included IP and email addresses, usernames and passwords stored as salted MD5 hashes alongside the private message history of the website's admin.
Email addressesIP addressesPasswordsPrivate messagesUsernames
22.8M accounts
covve.com · breached Feb 2020 · added May 15, 2020
Covve
In February 2020, a massive trove of personal information referred to as "db8151dd" was provided to HIBP after being found left exposed on a publicly facing Elasticsearch server. Later identified as originating from the Covve contacts app, the exposed data included extensive personal information and interactions between Covve users and their contacts. The data was provided to HIBP by dehashed.com.
Email addressesJob titlesNamesPhone numbersPhysical addressesSocial media profiles
777.8K accounts
ulmon.com · breached Jan 2020 · added May 8, 2020
Ulmon
In January 2020, the travel app creator Ulmon suffered a data breach. The service had almost 1.3M records with 777k unique email addresses, names, passwords stored as bcrypt hashes and in some cases, social media profile IDs, telephone numbers and bios. The data was subsequently posted to a popular hacking forum.
BiosEmail addressesNamesPasswordsPhone numbersSocial media profiles
2.3M accounts
elanic.in · breached Jan 2018 · added May 4, 2020
Elanic
In January 2020, the Indian fashion marketplace Elanic had 2.8M records with 2.3M unique email addresses posted publicly to a popular hacking forum. Elanic confirmed that they had "verified the data and it was pulled from one of our test servers where this data was exposed publicly" and that the data was "old" (the hacking forum reported it as being from 2016-2018). When asked about disclosure to impacted customers,…
Email addressesGeographic locationsUsernames
7.3M accounts
tailieu.vn · breached Nov 2019 · added May 3, 2020
TaiLieu
In November 2019, the Vietnamese education website TaiLieu allegedly suffered a data breach exposing 7.3M customer records. Impacted data included names and usernames, email addresses, dates of birth, genders and passwords stored as unsalted MD5 hashes. The data was provided to HIBP by dehashed.com after being shared on a popular hacking forum. TaiLieu did not respond when contacted about the incident.
Dates of birthEmail addressesGendersGeographic locationsNamesPasswordsPhone numbersUsernames
71.4M accounts
tokopedia.com · breached Apr 2020 · added May 2, 2020
Tokopedia
In April 2020, Indonesia's largest online store Tokopedia suffered a data breach. The incident resulted in 15M rows of data being posted to a popular hacking forum. An additional 76M rows were later provided to HIBP in July 2020. In total, the data included over 71M unique email addresses alongside names, genders, birth dates and passwords stored as SHA2-384 hashes.
Dates of birthEmail addressesGendersNamesPasswords
94.4K accounts
vianet.com.np · breached Apr 2020 · added Apr 22, 2020
Vianet
In April 2020, the Nepalese internet service provider Vianet suffered a data breach. The attack on the ISP led to the exposure of 177k customer records including 94k unique email addresses. Also exposed were names, phone numbers and physical addresses.
Email addressesNamesPhone numbersPhysical addresses
20M accounts
aptoide.com · breached Apr 2020 · added Apr 19, 2020
Aptoide
In April 2020, the independent Android app store Aptoide suffered a data breach. The incident resulted in the exposure of 20M customer records which were subsequently shared online via a popular hacking forum. Impacted data included email and IP addresses, names, IP addresses and passwords stored as SHA-1 hashes without a salt.
Browser user agent detailsEmail addressesIP addressesNamesPasswords
1.5M accounts
htcmania.com · breached Jan 2020 · added Apr 6, 2020
HTC Mania
In January 2020, the Spanish mobile phone forum HTC Mania suffered a data breach of the vBulletin based site. The incident exposed 1.5M member email addresses, usernames, IP addresses, dates of birth and salted MD5 password hashes and password histories. Data from the breach was subsequently redistributed on popular hacking websites.
Dates of birthEmail addressesHistorical passwordsIP addressesPasswordsUsernames
263.2K accounts
ogusers.com · breached Apr 2020 · added Apr 4, 2020
OGUsers (2020 breach)
In April 2020, the account hijacking and SIM swapping forum OGUsers suffered their second data breach in less than a year. As with the previous breach, the exposed data included email and IP addresses, usernames, private messages and passwords stored as salted MD5 hashes. A total of 263k email addresses across user accounts and other tables were posted to a rival hacking forum.
Email addressesIP addressesPasswordsPrivate messagesUsernames
6.5M accounts
duelingnetwork.com · breached Mar 2017 · added Mar 30, 2020
Dueling Network
In March 2017, the Flash game based on the Yu-Gi-Oh trading card game Dueling Network suffered a data breach. The site itself was taken offline in 2016 due to a cease-and-desist order but the forum remained online for another year. The data breach exposed usernames, IP and email addresses and passwords stored as MD5 hashes.
Email addressesIP addressesPasswordsUsernames
494.9K accounts
tamodo.com · breached Feb 2020 · added Mar 24, 2020
Tamodo
In February 2020, the affiliate marketing network Tamodo suffered a data breach which was subsequently shared on a popular hacking forum. The incident exposed almost 500k accounts including names, email addresses, dates of birth and passwords stored as bcrypt hashes. Tamodo failed to respond to multiple attempts to report the breach via published communication channels.
Dates of birthEmail addressesGendersGeographic locationsIP addressesNamesPasswords
2.2M accounts
proptiger.com · breached Jan 2018 · added Mar 24, 2020
PropTiger
In January 2018, the Indian property website PropTiger suffered a data breach which resulted in a 3.46GB database file being exposed and subsequently shared extensively on a popular hacking forum 2 years later. The exposed data contained both user records and login histories with over 2M unique customer email addresses. Exposed data also included additional personal attributes such as names, dates of birth, genders,…
Dates of birthDevice informationEmail addressesGendersIP addressesNamesPasswords
10.7K accounts
thehalloweenspot.com · breached Sep 2019 · added Mar 16, 2020
The Halloween Spot
In September 2019, the Halloween costume store The Halloween Spot suffered a data breach. Originally misattributed to fancy dress store Smiffys, the breach contained 13GB of data with over 10k unique email addresses alongside names, physical and IP addresses, phone numbers and order histories. The Halloween Spot advised customers the breach was traced back to "an old shipping information database".
Email addressesIP addressesNamesPhone numbersPhysical addressesPurchases
1.4M accounts
animegame.me · breached Feb 2020 · added Mar 9, 2020
AnimeGame
In February 2020, the gaming website AnimeGame suffered a data breach. The incident affected 1.4M subscribers and exposed email addresses, usernames and passwords stored as salted MD5 hashes. The data was subsequently shared on a popular hacking forum and was provided to HIBP by dehashed.com.
Email addressesPasswordsUsernames
48.6M accounts
straffic.io · breached Feb 2020 · added Feb 27, 2020
Straffic
In February 2020, Israeli marketing company Straffic exposed a database with 140GB of personal data. The publicly accessible Elasticsearch database contained over 300M rows with 49M unique email addresses. Exposed data also included names, phone numbers, physical addresses and genders. In their breach disclosure message, Straffic stated that "it is impossible to create a totally immune system, and these things can o…
Email addressesGendersNamesPhone numbersPhysical addresses
857.6K accounts
slickwraps.com · breached Feb 2020 · added Feb 22, 2020
Slickwraps
In February 2020, the online store for consumer electronics wraps Slickwraps suffered a data breach. The incident resulted in the exposure of 858k unique email addresses across customer records and newsletter subscribers. Additional impacted data included names, physical addresses, phone numbers and purchase histories.
Email addressesNamesPhone numbersPhysical addressesPurchases
3.1M accounts
mgmresorts.com · breached Jul 2019 · added Feb 20, 2020
MGM Resorts
In July 2019, MGM Resorts discovered a data breach of one of their cloud services. The breach included 10.6M guest records with 3.1M unique email addresses stemming back to 2017. The exposed data included email and physical addresses, names, phone numbers and dates of birth and was subsequently shared on a popular hacking forum in February 2020 where it was extensively redistributed. The data was provided to HIBP by…
Dates of birthEmail addressesNamesPhone numbersPhysical addresses
464.3K accounts
dailyobjects.com · breached Jan 2018 · added Jan 28, 2020
DailyObjects
In approximately January 2018, a collection of more than 464k customer records from the Indian online retailer DailyObjects were leaked online. The data included names, physical and email addresses, phone numbers and "pincodes" stored in plain text. After multiple attempts to contact them, DailyObjects responded and received a copy of the data for verification, however failed to respond to multiple contact attempts …
Email addressesNamesPasswordsPhone numbersPhysical addresses
652.7K accounts
tout.com · breached Sep 2014 · added Jan 25, 2020
Tout
In approximately September 2014, the now defunct social networking service Tout suffered a data breach. The breach subsequently appeared years later and included 653k unique email addresses, names, IP addresses, the location of the user, their bio and passwords stored as bcrypt hashes.
BiosEmail addressesGeographic locationsIP addressesNamesPasswordsUsernames
226.1K accounts
europa.jobs · breached Aug 2019 · added Jan 15, 2020
europa.jobs
In August 2019, the now defunct European jobs website europa.jobs (Google cache link) suffered a data breach. The incident exposed 226k unique email addresses alongside extensive personal information including names, dates of birth, job applications and passwords. The data was subsequently redistributed on a popular hacking forum.
Dates of birthEmail addressesGeographic locationsJob applicationsNamesPasswordsPhone numbersSpoken languages
62.3K accounts
planetcalypsoforum.com · breached Jul 2019 · added Jan 12, 2020
Planet Calypso
In approximately July 2019, the forums for the Planet Calypso game suffered a data breach. The breach of the vBulletin based forum exposed email and IP addresses, usernames and passwords stored as salted MD5 hashes.
Email addressesIP addressesPasswordsUsernames
444.2K accounts
btobet.com · breached Dec 2019 · added Jan 11, 2020
BtoBet
In December 2019, a large collection of data from Nigerian gambling company Surebet247 was sent to HIBP. Alongside the Surebet247, database backups from gambling sites BetAlfa, BetWay, BongoBongo and TopBet was also included. Further investigation implicated betting platform provider BtoBet as being the common source of the data. Impacted data included user records and extensive information on gambling histories.
Dates of birthEmail addressesFinancial transactionsGeographic locationsIP addressesNamesUsernames
3.4M accounts
gogames.me · breached Oct 2015 · added Jan 11, 2020
Go Games
In approximately October 2015, the manga website Go Games suffered a data breach. The exposed data included 3.4M customer records including email and IP addresses, usernames and passwords stored as salted MD5 hashes. Go Games did not respond when contacted about the incident. The data was provided to HIBP by dehashed.com.
Email addressesIP addressesPasswordsUsernames
583.4K accounts
indianrails.in · breached Oct 2019 · added Jan 10, 2020
Indian Railways
In November 2019, the website for Indian Rail left more than 2M records exposed on an unprotected Firebase database instance. The exposed data included 583k unique email addresses alongside usernames and passwords stored in plain text.
Email addressesPasswordsUsernames
565K accounts
universarium.org · breached Nov 2019 · added Jan 3, 2020
Universarium
In approximately November 2019, the Russian "Remote preparatory faculty for IT specialties" Universarium suffered a data breach. The incident exposed 565k email addresses and passwords in plain text. Universarium did not respond to multiple attempts to make contact over a period of many weeks. The data was provided to HIBP by dehashed.com.
Email addressesPasswords
Breach data from Have I Been Pwned. Breaches HIBP marks as sensitive are not listed.