950breaches
17.2Baccounts exposed
8added in 30 days
8.9Maccounts in 30 days
950 results.
2.5M accounts
factual.com · breached Mar 2017 · added Dec 24, 2019
Factual
In March 2017, a file containing 8M rows of data allegedly sourced from data aggregator Factual was compiled and later exchanged on the premise it was a "breach". The data contained 2.5M unique email addresses alongside business names, addresses and phone numbers. After consultation with Factual, they advised the data was "publicly available information about businesses and other points of interest that Factual make…
Email addressesEmployersPhone numbersPhysical addresses
172.9M accounts
zynga.com · breached Sep 2019 · added Dec 19, 2019
Zynga
In September 2019, game developer Zynga (the creator of Words with Friends) suffered a data breach. The incident exposed 173M unique email addresses alongside usernames and passwords stored as salted SHA-1 hashes. The data was provided to HIBP by dehashed.com.
Email addressesPasswordsPhone numbersUsernames
90.5K accounts
agusiq-torrents.pl · breached Sep 2019 · added Dec 4, 2019
AgusiQ-Torrents.pl
In September 2019, Polish torrent site AgusiQ-Torrents.pl suffered a data breach. The incident exposed 90k member records including email and IP addresses, usernames and passwords stored as MD5 hashes.
Email addressesIP addressesPasswordsUsernames
622.2M accounts
breached Oct 2019 · added Nov 22, 2019
Data Enrichment Exposure From PDL Customer
In October 2019, security researchers Vinny Troia and Bob Diachenko identified an unprotected Elasticsearch server holding 1.2 billion records of personal data. The exposed data included an index indicating it was sourced from data enrichment company People Data Labs (PDL) and contained 622 million unique email addresses. The server was not owned by PDL and it's believed a customer failed to properly secure the data…
Email addressesEmployersGeographic locationsJob titlesNamesPhone numbersSocial media profiles
1.4M accounts
gatehub.net · breached Jun 2019 · added Nov 20, 2019
GateHub
In October 2019, 1.4M accounts from the cryptocurrency wallet service GateHub were posted to a popular hacking forum. GateHub had previously acknowledged a data breach in June, albeit with a smaller number of impacted accounts. Data from the breach included email addresses, mnemonic phrases, encrypted master keys, encrypted recovery keys and passwords stored as bcrypt hashes.
Email addressesEncrypted keysMnemonic phrasesPasswords
816.7K accounts
epicbot.com · breached Sep 2019 · added Nov 19, 2019
EpicBot
In September 2019, the RuneScape bot provider EpicBot suffered a data breach that impacted 817k subscribers. Data from the breach was subsequently shared on a popular hacking forum and included usernames, email and IP addresses and passwords stored as either salted MD5 or bcrypt hashes. EpicBot did not respond when contacted about the incident.
Email addressesIP addressesPasswordsUsernames
669.6K accounts
gpsunderground.com · breached Jul 2016 · added Nov 19, 2019
GPS Underground
In early 2017, GPS Underground was amongst a collection of compromised vBulletin websites that were found being sold online. The breach dated back to mid-2016 and included 670k records with usernames, email and IP addresses, dates of birth and salted MD5 password hashes.
Dates of birthEmail addressesIP addressesPasswordsUsernames
6M accounts
toondoo.com · breached Aug 2019 · added Nov 11, 2019
ToonDoo
In August 2019, the comic strip creation website ToonDoo suffered a data breach. The data was subsequently redistributed on a popular hacking forum in November where the personal information of over 6M subscribers was shared. Impacted data included email and IP addresses, usernames, genders, the location of the individual and salted password hashes.
Email addressesGendersGeographic locationsIP addressesPasswordsUsernames
686.9K accounts
vedantu.com · breached Jul 2019 · added Nov 1, 2019
Vedantu
In mid-2019, the Indian interactive online tutoring platform Vedantu suffered a data breach which exposed the personal data of 687k users. The JSON formatted database dump exposed extensive personal information including email and IP address, names, phone numbers, genders and passwords stored as bcrypt hashes. When contacted about the incident, Vedantu advised that they were aware of the breach and were in the proce…
Browser user agent detailsEmail addressesGendersIP addressesNamesPasswordsPhone numbersSpoken languagesTime zonesWebsite activity
988.2K accounts
streeteasy.com · breached Jun 2016 · added Oct 6, 2019
StreetEasy
In approximately June 2016, the real estate website StreetEasy suffered a data breach. In total, 988k unique email addresses were included in the breach alongside names, usernames and SHA-1 hashes of passwords, all of which appeared for sale on a dark web marketplace in February 2019.
Email addressesNamesPasswordsUsernames
780.1K accounts
sephora.com.au · breached Jan 2017 · added Oct 6, 2019
Sephora
In approximately January 2017, the beauty store Sephora suffered a data breach. Impacting customers in South East Asia, Australia and New Zealand, 780k unique email addresses were included in the breach alongside names, genders, dates of birth, ethnicities and other personal information.
Dates of birthEmail addressesEthnicitiesGendersNamesPhysical attributes
23.2M accounts
wanelo.com · breached Dec 2018 · added Sep 30, 2019
Wanelo
In approximately December 2018, the digital mall Wanelo suffered a data breach. The data was later placed up for sale on a dark web marketplace along with a collection of other data breaches in April 2019. A total of 23 million unique email addresses were included in the breach alongside passwords stored as either MD5 or bcrypt hashes. After the initial HIBP load, further data containing names, shipping addresses an…
Email addressesIP addressesNamesPasswordsPhysical addresses
15.5M accounts
luminpdf.com · breached Apr 2019 · added Sep 18, 2019
Lumin PDF
In April 2019, the PDF management service Lumin PDF suffered a data breach. The breach wasn't publicly disclosed until September when 15.5M records of user data appeared for download on a popular hacking forum. The data had been left publicly exposed in a MongoDB instance after which Lumin PDF was allegedly been "contacted multiple times, but ignored all the queries". The exposed data included names, email addresses…
Auth tokensEmail addressesGendersNamesPasswordsSpoken languagesUsernames
4.6K accounts
kiwifarms.net · breached Sep 2019 · added Sep 17, 2019
KiwiFarms
In September 2019, the forum for discussing "lolcows" (people who can be milked for laughs) Kiwi Farms suffered a data breach. The disclosure notice advised that email and IP addresses, dates of birth and content created by members were all exposed in the incident.
AvatarsDates of birthEmail addressesIP addressesWebsite activity
396.5K accounts
minehut.com · breached May 2019 · added Sep 17, 2019
Minehut
In May 2019, the Minecraft server website Minehut suffered a data breach. The company advised a database backup had been obtained after which they subsequently notified all impacted users. 397k email addresses from the incident were provided to HIBP. A data set with both email addresses and bcrypt password hashes was also later provided to HIBP.
Email addressesPasswords
95.4K accounts
void.to · breached Jun 2019 · added Sep 11, 2019
Void.to
In June 2019, the hacking website Void.to suffered a data breach. There were 95k unique email addresses spread across 86k forum users and other tables in the database. A rival hacking website claimed responsibility for breaching the MyBB based forum which disclosed email and IP addresses, usernames, private messages and passwords stored as either salted MD5 or bcrypt hashes.
Email addressesIP addressesPasswordsPrivate messagesUsernames
36.4M accounts
poshmark.com · breached May 2018 · added Sep 2, 2019
Poshmark
In mid-2018, social commerce marketplace Poshmark suffered a data breach that exposed 36M user accounts. The compromised data included email addresses, names, usernames, genders, locations and passwords stored as bcrypt hashes.
Email addressesGendersGeographic locationsNamesPasswordsUsernames
89.4K accounts
specials.mastercard.de · breached Aug 2019 · added Sep 1, 2019
Mastercard Priceless Specials
In August 2019, the German Mastercard bonus program "Priceless Specials" suffered a data breach. Personal data on almost 90k program members was subsequently extensively circulated online and included names, email and IP addresses, phone numbers and partial credit card data. Following the incident, the program was subsequently suspended.
Email addressesIP addressesNamesPartial credit card dataPhone numbersSalutations
562K accounts
xkcd.com · breached Jul 2019 · added Sep 1, 2019
XKCD
In July 2019, the forum for webcomic XKCD suffered a data breach that impacted 562k subscribers. The breached phpBB forum leaked usernames, email and IP addresses and passwords stored in MD5 phpBB3 format. The data was provided to HIBP by white hat security researcher and data analyst Adam Davies.
Email addressesIP addressesPasswordsUsernames
478.8K accounts
coinmama.com · breached Aug 2017 · added Aug 30, 2019
Coinmama
In August 2017, the crypto coin brokerage service Coinmama suffered a data breach that impacted 479k subscribers. The breach was discovered in February 2019 with exposed data including email addresses, usernames and passwords stored as MD5 WordPress hashes. The data was provided to HIBP by white hat security researcher and data analyst Adam Davies.
Email addressesPasswordsUsernames
39.7M accounts
chegg.com · breached Apr 2018 · added Aug 16, 2019
Chegg
In April 2018, the textbook rental service Chegg suffered a data breach that impacted 40 million subscribers. The exposed data included email addresses, usernames, names and passwords stored as unsalted MD5 hashes. A small number of records also contained physical address or phone number.
Email addressesNamesPasswordsPhone numbersPhysical addressesUsernames
749.2K accounts
cracked.to · breached Jul 2019 · added Aug 12, 2019
Cracked.to
In July 2019, the hacking website Cracked.to suffered a data breach. There were 749k unique email addresses spread across 321k forum users and other tables in the database. A rival hacking website claimed responsibility for breaching the MyBB based forum which disclosed email and IP addresses, usernames, private messages and passwords stored as bcrypt hashes.
Email addressesIP addressesPasswordsPrivate messagesUsernames
6.8M accounts
stockx.com · breached Jul 2019 · added Aug 10, 2019
StockX
In July 2019, the fashion and sneaker trading platform StockX suffered a data breach which was subsequently sold via a dark webmarketplace. The exposed data included 6.8 million unique email addresses, names, physical addresses, purchases and passwords stored as salted MD5 hashes. The data was provided to HIBP by dehashed.com.
Email addressesNamesPasswordsPhysical addressesPurchasesUsernames
137.3M accounts
canva.com · breached May 2019 · added Aug 9, 2019
Canva
In May 2019, the graphic design tool website Canva suffered a data breach that impacted 137 million subscribers. The exposed data included email addresses, usernames, names, cities of residence and passwords stored as bcrypt hashes for users not using social logins.
Email addressesGeographic locationsNamesPasswordsUsernames
23.2M accounts
cafepress.com · breached Feb 2019 · added Aug 5, 2019
CafePress
In February 2019, the custom merchandise retailer CafePress suffered a data breach. The exposed data included 23 million unique email addresses with some records also containing names, physical addresses, phone numbers and passwords stored as SHA-1 hashes.
Email addressesNamesPasswordsPhone numbersPhysical addresses
4M accounts
cprewritten.net · breached Jul 2019 · added Jul 30, 2019
Club Penguin Rewritten (July 2019)
In July 2019, the children's gaming site Club Penguin Rewritten (CPRewritten) suffered a data breach (note: CPRewritten is an independent recreation of Disney's Club Penguin game). In addition to an earlier data breach that impacted 1.7 million accounts, the subsequent breach exposed 4 million unique email addresses alongside IP addresses, usernames and passwords stored as bcrypt hashes.
Email addressesIP addressesPasswordsUsernames
368.5K accounts
anime-planet.com · breached Jan 2016 · added Jul 28, 2019
Anime-Planet
In approximately 2016, the anime website Anime-Planet suffered a data breach that impacted 369k subscribers. The exposed data included usernames, IP and email addresses, dates of birth and passwords stored as unsalted MD5 hashes and for newer accounts, bcrypt hashes. The data was provided to HIBP by dehashed.com.
Dates of birthEmail addressesIP addressesPasswordsUsernames
408.8K accounts
epicnpc.com · breached Jan 2016 · added Jul 27, 2019
EpicNPC
In January 2016, the hacked account reseller EpicNPC suffered a data breach that impacted 409k subscribers. The impacted data included usernames, IP and email addresses and passwords stored as salted MD5 hashes. The data was provided to HIBP by dehashed.com.
Email addressesIP addressesPasswordsUsernames
1.6M accounts
f.elex.com · breached Jul 2016 · added Jul 27, 2019
Clash of Kings
In July 2016, the forum for the game "Clash of Kings" suffered a data breach that impacted 1.6 million subscribers. The impacted data included usernames, IP and email addresses and passwords stored as MD5 hashes. The data was provided to HIBP by dehashed.com.
Email addressesIP addressesPasswordsUsernames
1.4M accounts
snail.com · breached Mar 2015 · added Jul 27, 2019
Snail
In March 2015, the gaming website Snail suffered a data breach that impacted 1.4 million subscribers. The impacted data included usernames, IP and email addresses and passwords stored as unsalted MD5 hashes. The data was provided to HIBP by dehashed.com.
Email addressesIP addressesPasswordsUsernames
Breach data from Have I Been Pwned. Breaches HIBP marks as sensitive are not listed.