950breaches
17.2Baccounts exposed
8added in 30 days
8.9Maccounts in 30 days
950 results.
216.6K accounts
americantower.com · breached Jun 2026 · added Jun 26, 2026
American Tower
In June 2026, telecommunications tower infrastructure company American Tower was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly taken from the company containing more than 200k unique email addresses belonging to employees, contractors, customers, and leads. Exposed data also included names, addresses, and phone numbers.
Email addressesJob titlesNamesPhone numbersPhysical addresses
9.8M accounts
msgsports.com · breached Jun 2026 · added Jun 24, 2026
Madison Square Garden Sports
In June 2026, the sports and entertainment company Madison Square Garden Sports was the target of a ShinyHunters "pay or leak" extortion campaign. The group later published the alleged data, which included almost 10M unique email addresses spanning staff and customers, along with extensive personal, employment and customer relationship information.
Customer service recordsEmail addressesNamesPhone numbersPhysical addresses
368.4K accounts
jcpenny.com · breached Jun 2026 · added Jun 20, 2026
JCPenney
In June 2026, retailer JCPenney and associated brands were targeted in a ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from JCPenney through the exploitation of a critical zero-day vulnerability in Oracle PeopleSoft was later published publicly. The exposed records indicated they primarily related to internal HR systems and impacted current and former employees. The data included 368k corpor…
Dates of birthEmail addressesGovernment issued IDsJob titlesNamesPhone numbersPhysical addressesUsernames
139.9K accounts
ralphlauren.com · breached Jun 2026 · added Jun 18, 2026
Ralph Lauren
In June 2026, fashion retailer Ralph Lauren was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published hundreds of gigabytes of data they claimed was obtained from the organisation's Salesforce instance, including 140k unique email addresses along with names, phone numbers, genders and age groups.
Age groupsEmail addressesGendersNamesPhone numbers
4.3M accounts
breached Jun 2026 · added Jun 18, 2026
Malware logs
Operation Endgame 4.0
On 18 June 2026, the latest phase of Operation Endgame targeted the SocGholish malware operation, a prolific malware distribution network used to compromise systems and facilitate further cybercrime. Coordinated by international law enforcement agencies with support from Europol and Eurojust, the operation remediated almost 15,000 compromised websites and disrupted more than 100 servers and domains used to distribut…
Email addressesPasswords
248.2K accounts
cfgi.com · breached Mar 2026 · added Jun 18, 2026
CFGI
In March 2026, the financial consulting and advisory firm CFGI was the target of a ShinyHunters "pay-or-leak" extortion campaign. The group subsequently publicised data allegedly obtained from CFGI comprising corporate contact information, including 243k unique email addresses, names, phone numbers and physical addresses.
Email addressesEmployersJob titlesNamesPhone numbersPhysical addresses
56.3M accounts
breached Jun 2026 · added Jun 15, 2026
Malware logs
June 2026 Stealer Logs
In June 2026, a collection of accumulated stealer logs from various sources was added to HIBP. The corpus comprised 56M unique email addresses across hundreds of millions of stealer log records. The data also contained 124M unique passwords, which have been added to Pwned Passwords and are now searchable. Individuals can view any records captured against their email address in the stealer logs section of their dashb…
Email addressesPasswords
305.2K accounts
berkadia.com · breached Mar 2026 · added Jun 15, 2026
Berkadia
In March 2026, the commercial real estate finance company Berkadia was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they alleged was taken from Berkadia's Salesforce instance, including over 300k unique email addresses as well as names, physical addresses and phone numbers, among other data.
Email addressesEmployersNamesPhone numbersPhysical addresses
137.1K accounts
infinitecampus.com · breached Mar 2026 · added Jun 15, 2026
Infinite Campus
In March 2026, the student information system Infinite Campus was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they alleged was taken from Infinite Campus, containing 137k unique email addresses along with names, phone numbers, physical addresses and support tickets. Infinite Campus subsequently sent notifications, advising that the exposed data largely consisted…
Email addressesEmployersJob titlesNamesPhone numbersPhysical addressesSupport ticketsUsernames
454.6K accounts
nottingham.ac.uk · breached Jun 2026 · added Jun 10, 2026
University of Nottingham
In June 2026, the University of Nottingham was the target of a cyber attack, later linked to a ShinyHunters "pay or leak" extortion campaign. Tens of gigabytes of data were subsequently published online and included 455k unique email addresses along with extensive personal information including names, addresses, phone numbers, ethnicities, disabilities, passport numbers and information relating to academic enrolment…
Academic recordsCitizenship statusesDates of birthDisabilitiesEmail addressesEthnicitiesGendersIP addressesNamesPassport numbersPhone numbersPhysical addressesPurchasesSalutationsUsernames
102.9K accounts
bakerdist.com · breached May 2026 · added Jun 7, 2026
Baker Distributing
In May 2026, the HVAC/R wholesale distributor Baker Distributing Company was added to the ShinyHunters data extortion group's "pay or leak" site. In early June, the group publicly published data they claimed had been obtained from Baker's SharePoint and Salesforce infrastructure including 103k unique email addresses along with names, physical addresses, phone numbers and tickets relating to the company's HVAC contra…
Email addressesNamesPhone numbersPhysical addressesSupport tickets
396.3K accounts
bcdtravel.com · breached May 2026 · added Jun 5, 2026
BCD Travel
In May 2026, the corporate travel management company BCD Travel was claimed as a victim of the ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from BCD was subsequently published publicly in early June and contained 396k unique email addresses. Other exposed data included names, addresses, phone numbers, job titles and employer names, spanning a variety of different data sets including leads, …
Email addressesEmployersJob titlesNamesPhone numbersPhysical addressesSupport tickets
2.6M accounts
dentaquest.com · breached May 2026 · added Jun 3, 2026
DentaQuest
In May 2026, the dental benefits administrator DentaQuest was the target of a ShinyHunters "pay or leak" extortion campaign that resulted in the group publicly publishing hundreds of gigabytes of data allegedly obtained from the company. The data included 2.6M unique email addresses along with names, addresses and phone numbers. Much of the data appeared in healthcare enrollment files (ASC X12 transaction sets) with…
Dates of birthEmail addressesGendersGovernment issued IDsHealth insurance informationNamesPhone numbersPhysical addresses
177.9K accounts
edmunds.com · breached Jan 2026 · added Jun 1, 2026
Edmunds
In January 2026, the automotive research and car-shopping platform Edmunds was listed by the ShinyHunters hacking group as having been breached. Data purportedly obtained in the incident was later published publicly and included 178k unique email addresses, usernames, passwords, IP addresses, phone numbers and vehicle-related records.
Device informationEmail addressesIP addressesPasswordsPhone numbersUsernames
63.9K accounts
atlasmenu.net · breached May 2026 · added May 30, 2026
Atlas Menu
In May 2026, the GTA V and CS2 cheat service Atlas Menu suffered a data breach. An attacker claimed to have gained access to all Atlas systems and published the service's database to a public GitHub repository. The incident exposed 64k unique email addresses along with usernames, IP addresses, support tickets and passwords stored as bcrypt hashes.
Email addressesIP addressesPasswordsSupport ticketsUsernames
4.9M accounts
charter.com · breached May 2026 · added May 28, 2026
Charter
In May 2026, the telecommunications company Charter Communications (the parent company behind the consumer broadband and cable brand Spectrum) was named by the ShinyHunters group in a "pay or leak" extortion campaign. The group later published the data, which exposed 4.9M unique email addresses along with names, phone numbers and physical addresses. A subset of approximately 85k records originating from an internal …
Email addressesJob titlesNamesPhone numbersPhysical addresses
269.3K accounts
kemper.com · breached Apr 2026 · added May 28, 2026
Kemper
In April 2026, the American insurance holding company Kemper Corporation was named by the ShinyHunters ransomware group in a "pay or leak" extortion campaign. The attackers allegedly accessed Kemper's Salesforce environment via social engineering as part of a broader campaign targeting hundreds of organisations using the same method. The group later published tens of gigabytes of data they claimed included internal …
Email addressesNamesPartial credit card dataPhone numbersPhysical addressesPurchases
84.1K accounts
mytheresa.com · breached Apr 2026 · added May 27, 2026
Mytheresa
In April 2026, the luxury fashion e-commerce platform Mytheresa was listed as a victim of the ShinyHunters "pay or leak" extortion group. After the ransom deadline passed, the group publicly released the data which contained 84k unique email addresses. The exposed data also included names, phone numbers, physical addresses, purchases and partial credit card data including card type, last 4 digits and expiry date.
Email addressesNamesPartial credit card dataPhone numbersPhysical addressesPurchasesSalutations
502.6K accounts
ameriprise.com · breached Mar 2026 · added May 26, 2026
Ameriprise
In March 2026, the financial services firm Ameriprise Financial was named by the ShinyHunters group in a "pay or leak" extortion campaign. The group claimed possession of more than 200GB of compressed data exfiltrated from Ameriprise's Salesforce environment and internal SharePoint infrastructure, and subsequently published the data after negotiations allegedly failed. The published data contained 500k unique email …
Email addressesEmployersFinancial transactionsJob titlesNamesPhone numbersPhysical addresses
185.3K accounts
7-eleven.com · breached Apr 2026 · added May 24, 2026
7-Eleven
In April 2026, 7-Eleven was the victim of a "pay or leak" extortion campaign by ShinyHunters, with the data later published that month. The incident exposed 185k unique email addresses, along with names, physical addresses, dates of birth and phone numbers. A small number of records also contained additional exposed data fields. The company later advised the breach was limited to "certain 7-Eleven systems used to st…
Dates of birthEmail addressesNamesPhone numbersPhysical addresses
126.3K accounts
playdragonica.eu · breached Dec 2025 · added May 21, 2026
Dragonica Lunaris
In December 2025, the European Dragonica private server Dragonica Lunaris suffered a data breach. The incident exposed 126k email addresses, usernames, dates of birth and bcrypt password hashes. The service operator confirmed the breach and advised it has since been fixed.
Dates of birthEmail addressesNamesPasswordsSpoken languagesUsernames
46.1K accounts
windows93.net · breached Jan 2021 · added May 21, 2026
Windows93 / Myspace93
In January 2021, the parody site Windows93 suffered a data breach of the Myspace93 sub-site after a beta application was exploited to download server files. The compromised data was later leaked in June and included 46k Myspace93 accounts containing email and IP addresses, usernames and passwords stored in plain text.
Email addressesIP addressesPasswordsUsernames
468.1K accounts
ctt.pt · breached Apr 2026 · added May 19, 2026
CTT
In April 2026, data allegedly obtained from CTT, Portugal's national postal service, was posted to a public hacking forum. The data included 468k unique email addresses along with names, phone numbers and parcel tracking numbers which can be used to retrieve the tracking history of the parcel.
Email addressesNamesPhone numbers
34.5M accounts
addi.com · breached Mar 2026 · added May 18, 2026
Addi
In March 2026, the Colombian fintech company Addi identified unauthorised activity on its platform and advised customers that "it is possible that your personal information may have been compromised". The "pay or leak" extortion group ShinyHunters subsequently claimed responsibility and published a large trove of personal data allegedly obtained from Addi. The data included 34M unique email addresses from credit sco…
Age groupsCredit scoresDevice informationEmail addressesGovernment issued IDsIncome levelsIP addressesLatitude and longitude pairsNamesPhone numbersPhysical addressesPurchasesSocioeconomic levels
711.1K accounts
abrigo.com · breached Apr 2026 · added May 14, 2026
Abrigo
In April 2026, the fintech software company Abrigo was targeted in a "pay or leak" extortion attempt by the ShinyHunters group. Shortly after, data allegedly taken from the company's Salesforce instance was published publicly and contained over 700k unique email addresses belonging to both Abrigo staff and external contacts. Whilst separate from Abrigo's Salesforce compromise via the Drift application connector the …
Email addressesEmployersJob titlesNamesPhone numbersPhysical addresses
237.8K accounts
canadalife.com · breached Apr 2026 · added May 13, 2026
Canada Life
In April 2026, Canada Life was the victim of a "pay or leak" extortion campaign by the ShinyHunters group. The group subsequently published the data which contained over 200k unique email addresses along with names, phone numbers, physical addresses and, in some cases, customer support tickets. In their disclosure notice, Canada Life advised that "it is a small proportion of our customers who may have been impacted"…
Email addressesJob titlesNamesPhone numbersPhysical addressesSalutationsSupport tickets
310.4K accounts
cushmanwakefield.com · breached May 2026 · added May 12, 2026
Cushman & Wakefield
In May 2026, the real estate services firm Cushman & Wakefield was the target of a "pay or leak" extortion campaign by the ShinyHunters group. Following the threat, the group publicly published data they alleged had been obtained from the firm, consisting mostly of C&W; email addresses along with tens of thousands of external email addresses and corporate contact records. The exposed data was primarily business info…
Email addressesJob titlesNamesPhone numbersPhysical addressesSalutations
197.4K accounts
zara.com · breached Apr 2026 · added May 8, 2026
Zara
In April 2026, the fashion brand Zara was among a number of organisations targeted by the ShinyHunters extortion group as part of their "pay or leak" campaign. The group claimed the breach was related to a compromise of the Anodot analytics platform and subsequently published a terabyte of data allegedly including 95M support ticket records. The data contained 197k unique email addresses alongside product SKUs, orde…
Email addressesGeographic locationsPurchasesSupport tickets
447.6K accounts
woflow.com · breached Mar 2026 · added May 7, 2026
Woflow
In March 2026, the AI-driven merchant data platform Woflow was named as a victim by the ShinyHunters data extortion group. The group subsequently published tens of thousands of files allegedly obtained from the company, comprising more than 2TB of data. The trove included hundreds of thousands of email addresses, names, phone numbers and physical addresses, with the data indicating it related to Woflow customers and…
Email addressesNamesPhone numbersPhysical addresses
10.1K accounts
legionproxy.io · breached Apr 2026 · added May 6, 2026
LegionProxy
In April 2026, the commercial residential and ISP proxy network LegionProxy suffered a data breach. The incident exposed 10k email addresses, bcrypt password hashes, names and purchases.
Email addressesNamesPasswordsPurchases
Breach data from Have I Been Pwned. Breaches HIBP marks as sensitive are not listed.