950breaches
17.2Baccounts exposed
8added in 30 days
8.9Maccounts in 30 days
950 results.
105.1M accounts
breached Jul 2017 · added Jul 18, 2017
Spam list
B2B USA Businesses
In mid-2017, a spam list of over 105 million individuals in corporate America was discovered online. Referred to as "B2B USA Businesses", the list categorised email addresses by employer, providing information on individuals' job titles plus their work phone numbers and physical addresses. Read more about spam lists in HIBP.
Email addressesEmployersJob titlesNamesPhone numbersPhysical addresses
435.5K accounts
evermotion.org · breached May 2015 · added Jul 2, 2017
Evermotion
In May 2015, the Polish 3D modelling website known as Evermotion suffered a data breach resulting in the exposure of 435k unique user records. The data was sourced from a vBulletin forum and contained email addresses, usernames, dates of birth and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory.
Dates of birthEmail addressesPasswordsUsernames
707.4K accounts
programmingforums.org · breached Dec 2015 · added Jul 1, 2017
Programming Forums
In approximately late 2015, the programming forum at programmingforums.org suffered a data breach resulting in the exposure of 707k unique user records. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory.
Email addressesIP addressesPasswordsUsernames
503.5K accounts
powerbot.org · breached Sep 2014 · added Jul 1, 2017
Powerbot
In approximately September 2014, the RuneScape bot website Powerbot suffered a data breach resulting in the exposure of over half a million unique user records. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory.
Email addressesIP addressesPasswordsUsernames
890.3K accounts
xpgamesaves.com · breached Jan 2016 · added Jul 1, 2017
XPG
In approximately early 2016, the gaming website Xpgamesaves (XPG) suffered a data breach resulting in the exposure of 890k unique user records. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory. This data was provided by security researcher and data analyst, Adam Davies.
Email addressesIP addressesPasswordsUsernames
599.8K accounts
coachella.com · breached Feb 2017 · added Jun 27, 2017
Coachella
In February 2017, hundreds of thousands of records from the Coachella music festival were discovered being sold online. Allegedly taken from a combination of the main Coachella website and their vBulletin-based message board, the data included almost 600k usernames, IP and email addresses and salted hashes of passwords (MD5 in the case of the message board).
Email addressesIP addressesPasswordsUsernames
396.6K accounts
breached Jun 2017 · added Jun 9, 2017
Unverified
Exposed VINs
In June 2017, an unsecured database with more than 10 million VINs (vehicle identification numbers) was discovered by researchers. Believed to be sourced from US car dealerships, the data included a raft of personal information and vehicle data along with 397k unique email addresses.
Dates of birthEmail addressesFamily structureGendersNamesPhone numbersPhysical addressesVehicle details
8.2M accounts
breached Dec 2016 · added Jun 8, 2017
Unverified
Data Enrichment Records
In December 2016, more than 200 million "data enrichment profiles" were found for sale on the darknet. The seller claimed the data was sourced from Experian and whilst that claim was rejected by the company, the data itself was found to be legitimate suggesting it may have been sourced from other legitimate locations. In total, there were more than 8 million unique email addresses in the data which also contained a …
Buying preferencesCharitable donationsCredit status informationDates of birthEmail addressesFamily structureFinancial investmentsHome ownership statusesIncome levelsJob titlesMarital statusesNamesNet worthsPhone numbersPhysical addressesPolitical donations
776.1K accounts
abandonia.com · breached Nov 2015 · added Jun 5, 2017
Abandonia (2015)
In November 2015, the gaming website dedicated to classic DOS games Abandonia suffered a data breach resulting in the exposure of 776k unique user records. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords.
Email addressesIP addressesPasswordsUsernames
43.4M accounts
edmodo.com · breached May 2017 · added Jun 1, 2017
Edmodo
In May 2017, the education platform Edmodo was hacked resulting in the exposure of 77 million records comprised of over 43 million unique customer email addresses. The data was consequently published to a popular hacking forum and made freely available. The records in the breach included usernames, email addresses and bcrypt hashes of passwords.
Email addressesPasswordsUsernames
637.3K accounts
dafont.com · breached May 2017 · added May 18, 2017
DaFont
In May 2017, font sharing site DaFont suffered a data breach resulting in the exposure of 637k records. Allegedly due to a SQL injection vulnerability exploited by multiple parties, the exposed data included usernames, email addresses and passwords stored as MD5 without a salt.
Email addressesPasswordsUsernames
2.2M accounts
bell.ca · breached May 2017 · added May 16, 2017
Bell (2017 breach)
In May 2017, the Bell telecommunications company in Canada suffered a data breach resulting in the exposure of millions of customer records. The data was consequently leaked online with a message from the attacker stating that they were "releasing a significant portion of Bell.ca's data due to the fact that they have failed to cooperate with us" and included a threat to leak more. The impacted data included over 2 m…
Email addressesGeographic locationsIP addressesJob titlesNamesPasswordsPhone numbersSpoken languagesSurvey resultsUsernames
593.4M accounts
breached Oct 2016 · added May 6, 2017
Unverified
Exploit.In
In late 2016, a huge list of email address and password pairs appeared in a "combo list" referred to as "Exploit.In". The list contained 593 million unique email addresses, many with multiple different passwords hacked from various online systems. The list was broadly circulated and used for "credential stuffing", that is attackers employ it in an attempt to identify other online systems where the account owner had …
Email addressesPasswords
458M accounts
breached Dec 2016 · added May 4, 2017
Unverified
Anti Public Combo List
In December 2016, a huge list of email address and password pairs appeared in a "combo list" referred to as "Anti Public". The list contained 458 million unique email addresses, many with multiple different passwords hacked from various online systems. The list was broadly circulated and used for "credential stuffing", that is attackers employ it in an attempt to identify other online systems where the account owner…
Email addressesPasswords
1M accounts
r2games.com · breached Jan 2017 · added Apr 25, 2017
R2 (2017 forum breach)
In early 2017, the forum for the gaming website R2 Games was hacked. R2 had previously appeared on HIBP in 2015 after a prior incident. This one exposed over 1 million unique user accounts and corresponding MD5 password hashes with no salt.
Email addressesPasswordsUsernamesWebsite activity
2.4M accounts
fashionfantasygame.com · breached Dec 2016 · added Apr 20, 2017
FashionFantasyGame
In late 2016, the fashion gaming website Fashion Fantasy Game suffered a data breach. The incident exposed 2.3 million unique user accounts and corresponding MD5 password hashes with no salt. The data was contributed to Have I Been Pwned courtesy of [email protected].
Email addressesPasswords
91.9M accounts
youku.com · breached Dec 2016 · added Apr 15, 2017
Youku
In late 2016, the online Chinese video service Youku suffered a data breach. The incident exposed 92 million unique user accounts and corresponding MD5 password hashes. The data was contributed to Have I Been Pwned courtesy of [email protected].
Email addressesPasswords
321.9K accounts
healthnow.co · breached Mar 2017 · added Apr 7, 2017
Health Now Networks
In March 2017, the telemarketing service Health Now Networks left a database containing hundreds of thousands of medical records exposed. There were over 900,000 records in total containing significant volumes of personal information including names, dates of birth, various medical conditions and operator notes on the individuals' health. The data included over 320k unique email addresses.
Dates of birthEmail addressesGendersHealth insurance informationIP addressesNamesPersonal health dataPhone numbersPhysical addressesSecurity questions and answersSocial connections
501.4K accounts
bitcointalk.org · breached May 2015 · added Mar 27, 2017
Bitcoin Talk
In May 2015, the Bitcoin forum Bitcoin Talk was hacked and over 500k unique email addresses were exposed. The attack led to the exposure of a raft of personal data including usernames, email and IP addresses, genders, birth dates, security questions and MD5 hashes of their answers plus hashes of the passwords themselves.
Dates of birthEmail addressesGendersIP addressesPasswordsSecurity questions and answersUsernamesWebsite activity
29.4M accounts
evony.com · breached Jun 2016 · added Mar 25, 2017
Evony
In June 2016, the online multiplayer game Evony was hacked and over 29 million unique accounts were exposed. The attack led to the exposure of usernames, email and IP addresses and MD5 hashes of passwords (without salt).
Email addressesIP addressesPasswordsUsernames
611.1K accounts
hltv.org · breached Jun 2016 · added Mar 22, 2017
HLTV
In June 2016, the "home of competitive Counter Strike" website HLTV was hacked and 611k accounts were exposed. The attack led to the exposure of names, usernames, email addresses and bcrypt hashes of passwords.
Email addressesNamesPasswordsUsernamesWebsite activity
254.9K accounts
sweclockers.com · breached Apr 2015 · added Mar 22, 2017
SweClockers.com
In early 2015, the Swedish tech news site SweClockers was hacked and 255k accounts were exposed. The attack led to the exposure of usernames, email addresses and salted hashes of passwords stored with a combination of MD5 and SHA512.
Email addressesPasswordsUsernames
352.1K accounts
torrent-invites.com · breached Dec 2013 · added Mar 22, 2017
Torrent Invites
In December 2013, the torrent site Torrent Invites was hacked and over 352k accounts were exposed. The vBulletin forum contained usernames, email and IP addresses, birth dates and salted MD5 hashes of passwords.
Dates of birthEmail addressesIP addressesPasswordsUsernamesWebsite activity
130.7K accounts
soundwave.com · breached Jul 2015 · added Mar 17, 2017
Soundwave
In approximately mid 2015, the music tracking app Soundwave suffered a data breach. The breach stemmed from an incident whereby "production data had been used to populate the test database" and was then inadvertently exposed in a MongoDB. The data contained 130k records and included email addresses, dates of birth, genders and MD5 hashes of passwords without a salt.
Dates of birthEmail addressesGendersGeographic locationsNamesPasswordsSocial connections
2.2M accounts
wishbone.io · breached Aug 2016 · added Mar 15, 2017
Wishbone (2016)
In August 2016, the mobile app to "compare anything" known as Wishbone suffered a data breach. The data contained 9.4 million records with 2.2 million unique email addresses and was allegedly a subset of the complete data set. The exposed data included genders, birthdates, email addresses and phone numbers for an audience predominantly composed of teenagers and young adults.
Auth tokensDates of birthEmail addressesGendersNamesPhone numbersUsernames
33.7M accounts
netprospex.com · breached Sep 2016 · added Mar 15, 2017
Spam list
NetProspex
In 2016, a list of over 33 million individuals in corporate America sourced from Dun & Bradstreet's NetProspex service was leaked online. D&B; believe the targeted marketing data was lost by a customer who purchased it from them. It contained extensive personal and corporate information including names, email addresses, job titles and general information about the employer.
Email addressesEmployersJob titlesNamesPhone numbersPhysical addresses
1.6M accounts
sterkinekor.co.za · breached Mar 2017 · added Mar 13, 2017
Ster-Kinekor
In 2016, the South African cinema company Ster-Kinekor had a security flaw which leaked a large amount of customer data via an enumeration vulnerability in the API of their old website. Whilst more than 6 million accounts were leaked by the flaw, the exposed data only contained 1.6 million unique email addresses. The data also included extensive personal information such as names, addresses, birthdates, genders and …
Dates of birthEmail addressesGendersNamesPasswordsPhone numbersPhysical addressesSpoken languages
568.3K accounts
btc-e.com · breached Oct 2014 · added Mar 12, 2017
BTC-E
In October 2014, the Bitcoin exchange BTC-E was hacked and 568k accounts were exposed. The data included email and IP addresses, wallet balances and hashed passwords.
Account balancesEmail addressesIP addressesPasswordsUsernamesWebsite activity
393.4M accounts
rivercitymediaonline.com · breached Jan 2017 · added Mar 8, 2017
Spam list
River City Media Spam List
In January 2017, a massive trove of data from River City Media was found exposed online. The data was found to contain almost 1.4 billion records including email and IP addresses, names and physical addresses, all of which was used as part of an enormous spam operation. Once de-duplicated, there were 393 million unique email addresses within the exposed data.
Email addressesIP addressesNamesPhysical addresses
995.7K accounts
littlemonsters.com · breached Jan 2017 · added Mar 7, 2017
Little Monsters
In approximately January 2017, the Lady Gaga fan site known as "Little Monsters" suffered a data breach that impacted 1 million accounts. The data contained usernames, email addresses, dates of birth and bcrypt hashes of passwords.
Dates of birthEmail addressesPasswordsUsernames
Breach data from Have I Been Pwned. Breaches HIBP marks as sensitive are not listed.