950breaches
17.2Baccounts exposed
8added in 30 days
8.9Maccounts in 30 days
950 results.
9.4M accounts
adapt.io · breached Nov 2018 · added Nov 22, 2018
Adapt
In November 2018, security researcher Bob Diachenko identified an unprotected database hosted by data aggregator "Adapt". A provider of "Fresh Quality Contacts", the service exposed over 9.3M unique records of individuals and employer information including their names, employers, job titles, contact information and data relating to the employer including organisation description, size and revenue. No response was re…
Email addressesEmployersJob titlesNamesPhone numbersPhysical addressesSocial media profiles
5.8M accounts
breached Oct 2018 · added Nov 17, 2018
Elasticsearch Instance of Sales Leads on AWS
In October 2018, security researcher Bob Diachenko identified multiple exposed databases with hundreds of millions of records. One of those datasets was an Elasticsearch instance on AWS containing sales lead data and 5.8M unique email addresses. The data contained information relating to individuals and the companies they worked for including their names, email addresses and company name and contact information. Des…
Email addressesEmployersNamesPhysical addresses
2M accounts
knowncircle.com · breached Apr 2016 · added Nov 17, 2018
KnownCircle
In approximately April 2016, the "marketing automation for agents and professional service providers" company KnownCircle had a large volume of data obtained by an external party. The data belonging to the now defunct service appeared in JSON format and contained gigabytes of data related to the real estate and insurance sectors. The personal data in the breach appears to have primarily been used for marketing purpo…
Email addressesEmail messagesGendersNamesPasswordsPhone numbersPhysical addresses
150K accounts
rbx.rocks · breached Aug 2018 · added Nov 7, 2018
Rbx.Rocks
In August 2018, the Roblox trading site Rbx.Rocks suffered a data breach. Almost 25k records were sent to HIBP in November and included names, email addresses and passwords stored as bcrypt hashes. In July 2019, a further 125k records emerged bringing the total size of the incident to 150k. The website has since gone offline with a message stating that "Rbx.Rocks v2.0 is currently under construction".
Email addressesNamesPasswords
14.6K accounts
siae.it · breached Nov 2018 · added Nov 7, 2018
Società Italiana degli Autori ed Editori
In November 2018, the Società Italiana degli Autori ed Editori (Italian Society of Authors and Publishers, or SIAE) was hacked, defaced and almost 4GB of data leaked publicly via Twitter. The data included over 14k registered users' names, email addresses and passwords.
Email addressesIP addressesNamesPasswordsPhone numbers
858 accounts
wpsandbox.io · breached Nov 2018 · added Nov 6, 2018
WPSandbox
In November 2018, the WordPress sandboxing service that allows people to create temporary websites WP Sandbox discovered their service was being used to host a phishing site attempting to collect Microsoft OneDrive accounts. After identifying the malicious site, WP Sandbox took it offline, contacted the 858 people who provided information to it then self-submitted their addresses to HIBP. The phishing page requested…
Email addressesPasswords
22.5K accounts
joomlart.com · breached Jan 2018 · added Nov 1, 2018
JoomlArt
In January 2018, the Joomla template website JoomlArt inadvertently exposed more than 22k unique customer records in a Jira ticket. The exposed data was from iJoomla and JomSocial, both services that JoomlArt acquired the previous year. The data included usernames, email addresses, purchases and passwords stored as MD5 hashes. When contacted, JoomlArt advised they were aware of the incident and had previously notifi…
Email addressesNamesPasswordsPayment historiesUsernames
326.7K accounts
mac-forums.com · breached Jul 2016 · added Oct 29, 2018
Mac Forums
In July 2016, the self-proclaimed "Ultimate Source For Your Mac" website Mac Forums suffered a data breach. The vBulletin-based system exposed over 326k usernames, email and IP addresses, dates of birth and passwords stored as salted MD5 hashes. The data was later discovered being traded on a popular hacking forum. Mac Forums did not respond when contacted about the incident via their contact us form.
Dates of birthEmail addressesIP addressesPasswordsUsernames
846.7K accounts
babynames.com · breached Oct 2008 · added Oct 24, 2018
Baby Names
In approximately 2008, the site to help parents name their children known as Baby Names suffered a data breach. The incident exposed 846k email addresses and passwords stored as salted MD5 hashes. When contacted in October 2018, Baby Names advised that "the breach happened at least ten years ago" and that members were notified at the time.
Email addressesPasswords
342.9K accounts
facepunch.com · breached Jun 2016 · added Oct 17, 2018
Facepunch
In June 2016, the game development studio Facepunch suffered a data breach that exposed 343k users. The breached data included usernames, email and IP addresses, dates of birth and salted MD5 password hashes. Facepunch advised they were aware of the incident and had notified people at the time. The data was provided to HIBP by whitehat security researcher and data analyst Adam Davies.
Dates of birthEmail addressesIP addressesPasswordsUsernames
125.9M accounts
apollo.io · breached Jul 2018 · added Oct 5, 2018
Apollo
In July 2018, the sales engagement startup Apollo left a database containing billions of data points publicly exposed without a password. The data was discovered by security researcher Vinny Troia who subsequently sent a subset of the data containing 126 million unique email addresses to Have I Been Pwned. The data left exposed by Apollo was used in their "revenue acceleration platform" and included personal informa…
Email addressesEmployersGeographic locationsJob titlesNamesPhone numbersSalutationsSocial media profiles
7.7M accounts
digimon.co.in · breached Sep 2016 · added Sep 28, 2018
Spam list
Digimon
In September 2016, over 16GB of logs from a service indicated to be digimon.co.in were obtained, most likely from an unprotected Mongo DB instance. The service ceased running shortly afterwards and no information remains about the precise nature of it. Based on enquiries made via Twitter, it appears to have been a mail service possibly based on PowerMTA and used for delivering spam. The logs contained information in…
Email addressesEmail messagesIP addressesNames
307.8K accounts
realestatemogul.com · breached Sep 2016 · added Sep 24, 2018
Real Estate Mogul
In September 2016, the real estate investment site Real Estate Mogul had a Mongo DB instance compromised and 5GB of data downloaded by an unauthorised party. The data contained real estate listings including addresses and the names, phone numbers and 308k unique email addresses of the sellers. Real Estate Mogul was advised of the incident in September 2018 and stated that they "found no instance of user account cred…
Email addressesNamesPhone numbersPhysical addresses
3.5M accounts
nemoweb.net · breached Sep 2016 · added Sep 19, 2018
Spam list
NemoWeb
In September 2016, almost 21GB of data from the French website used for "standardised and decentralized means of exchange for publishing newsgroup articles" NemoWeb was leaked from what appears to have been an unprotected Mongo DB. The data consisted of a large volume of emails sent to the service and included almost 3.5M unique addresses, albeit many of them auto-generated. Multiple attempts were made to contact th…
Email addressesNames
41.8M accounts
breached Sep 2018 · added Sep 13, 2018
Unverified
Kayo.moe Credential Stuffing List
In September 2018, a collection of almost 42 million email address and plain text password pairs was uploaded to the anonymous file sharing service kayo.moe. The operator of the service contacted HIBP to report the data which, upon further investigation, turned out to be a large credential stuffing list. For more information, read about The 42M Record kayo.moe Credential Stuffing Data.
Email addressesPasswords
182.7K accounts
russianamerica.com · breached Jan 2017 · added Sep 13, 2018
Russian America
In approximately 2017, the website for Russian speakers in America known as Russian America suffered a data breach. The incident exposed 183k unique records including names, email addresses, phone numbers and passwords stored in both plain text and as MD5 hashes. Russian America was contacted about the breach but did not respond.
Email addressesNamesPasswordsPhone numbers
110.4K accounts
freshmenu.com · breached Jul 2016 · added Sep 10, 2018
FreshMenu
In July 2016, the India-based food delivery service FreshMenu suffered a data breach. The incident exposed the personal data of over 110k customers and included their names, email addresses, phone numbers, home addresses and order histories. When advised of the incident, FreshMenu acknowledged being already aware of the breach but stated they had decided not to notify impacted customers.
Device informationEmail addressesNamesPhone numbersPhysical addressesPurchases
1.1M accounts
warmane.com · breached Dec 2016 · added Sep 8, 2018
Warmane
In approximately December 2016, the online service for World of Warcraft private servers Warmane suffered a data breach. The incident exposed over 1.1M accounts including usernames, email addresses, dates of birth and salted MD5 password hashes. The data was subsequently extensively circulated online and was later provided to HIBP by whitehat security researcher and data analyst Adam Davies.
Dates of birthEmail addressesPasswordsUsernames
606.6K accounts
mortalonline.com · breached Jun 2018 · added Aug 31, 2018
Mortal Online
In June 2018, the massively multiplayer online role-playing game (MMORPG) Mortal Online suffered a data breach. A file containing 570k email addresses and cracked passwords was subsequently distributed online. A larger more complete file containing 607k email addresses with original unsalted MD5 password hashes along with names, usernames and physical addresses was later provided and the original breach in HIBP was …
Email addressesNamesPasswordsPhysical addressesUsernames
30.3K accounts
svenskamagic.com · breached Jul 2015 · added Aug 30, 2018
SvenskaMagic
Sometime in 2015, the Swedish magic website SvenskaMagic suffered a data breach that exposed over 30k records. The compromised data included usernames, email addresses and MD5 password hashes. The data was self-submitted to HIBP by SvenskaMagic.
Email addressesPasswordsUsernames
261.5K accounts
atlasquantum.com · breached Aug 2018 · added Aug 27, 2018
Atlas Quantum
In August 2018, the cryptocurrency investment platform Atlas Quantum suffered a data breach. The breach leaked the personal data of 261k investors on the platform including their names, phone numbers, email addresses and account balances.
Account balancesEmail addressesNamesPhone numbers
972.6K accounts
myfha.net · breached Feb 2015 · added Aug 9, 2018
MyFHA
In approximately February 2015, the home financing website MyFHA suffered a data breach which disclosed the personal information of nearly 1 million people. The data included extensive personal information relating to home financing including personal contact info, credit statuses, household incomes, loan amounts and notes on personal circumstances, often referring to legal issues, divorces and health conditions. Mu…
Credit status informationEmail addressesIncome levelsIP addressesLoan informationNamesPasswordsPersonal descriptionsPhysical addresses
45.1K accounts
lanwar.com · breached Jul 2018 · added Aug 8, 2018
Lanwar
In July 2018, staff of the Lanwar gaming site discovered a data breach they believe dates back to sometime over the previous several months. The data contained 45k names, email addresses, usernames and plain text passwords. A Lanwar staff member self-submitted the breach to HIBP and has also contacted the relevant authorities about the incident after identifying a phishing attempt to extort Bitcoin from a user.
Email addressesNamesPasswordsPhysical addressesUsernames
1.3M accounts
fashionnexus.co.uk · breached Jul 2018 · added Jul 31, 2018
Fashion Nexus
In July 2018, UK-based ecommerce company Fashion Nexus suffered a data breach which exposed 1.4 million records. Multiple websites developed by sister company White Room Solutions were impacted in the breach amongst which were sites including Jaded London and AX Paris. The various sites exposed in the incident included a range of different data types including names, phone numbers, addresses and passwords stored as …
Browser user agent detailsDates of birthEmail addressesGendersIP addressesNamesPasswordsPhone numbersPhysical addressesPurchases
339.5K accounts
leagueoflegends.com · breached Jun 2012 · added Jul 28, 2018
League of Legends
In June 2012, the multiplayer online game League of Legends suffered a data breach. At the time, the service had more than 32 million registered accounts and the breach affected various personal data attributes including "encrypted" passwords. In 2018, a 339k record subset of the data emerged with email addresses, usernames and plain text passwords, likely cracked from the original cryptographically protected ones.
Email addressesPasswordsUsernames
131.6M accounts
exactis.com · breached Jun 2018 · added Jul 25, 2018
Exactis
In June 2018, the marketing firm Exactis inadvertently publicly leaked 340 million records of personal data. Security researcher Vinny Troia of Night Lion Security discovered the leak contained multiple terabytes of personal information spread across hundreds of separate fields including addresses, phone numbers, family structures and extensive profiling data. The data was collected as part of Exactis' service as a …
Credit status informationDates of birthEducation levelsEmail addressesEthnicitiesFamily structureFinancial investmentsGendersHome ownership statusesIncome levelsIP addressesMarital statusesNamesNet worthsOccupationsPersonal interestsPhone numbersPhysical addressesReligionsSpoken languages
764.4K accounts
funny-games.biz · breached Apr 2018 · added Jul 24, 2018
Funny Games
In April 2018, the online entertainment site Funny Games suffered a data breach that disclosed 764k records including usernames, email and IP addresses and salted MD5 password hashes. The incident was disclosed to Funny Games in July who acknowledged the breach and identified it had been caused by legacy code no longer in use. The record count in the breach constitute approximately half of the user base.
Email addressesIP addressesPasswordsUsernames
111M accounts
pemiblanc.com · breached Apr 2018 · added Jul 9, 2018
Unverified
Pemiblanc
In April 2018, a credential stuffing list containing 111 million email addresses and passwords known as Pemiblanc was discovered on a French server. The list contained email addresses and passwords collated from different data breaches and used to mount account takeover attacks against other services. Read more about the incident.
Email addressesPasswords
5M accounts
yatra.com · breached Sep 2013 · added Jul 4, 2018
Yatra
In September 2013, the Indian bookings website known as Yatra had 5 million records exposed in a data breach. The data contained email and physical addresses, dates of birth and phone numbers along with both PINs and passwords stored in plain text. The site was previously reported as compromised on the Vigilante.pw breached database directory.
Dates of birthEmail addressesNamesPasswordsPhone numbersPhysical addressesPINs
30.5K accounts
lightshope.org · breached Jun 2018 · added Jul 4, 2018
Light's Hope
In June 2018, the World of Warcraft service Light's Hope suffered a data breach which they subsequently self-submitted to HIBP. Over 30K unique users were impacted and their exposed data included email addresses, dates of birth, private messages and passwords stored as bcrypt hashes.
Dates of birthEmail addressesGeographic locationsIP addressesPasswordsPrivate messagesUsernames
Breach data from Have I Been Pwned. Breaches HIBP marks as sensitive are not listed.