Nodebug

581.9K accounts canadagoose.com · breached Jul 2025 · added Feb 17, 2026

Canada Goose

In February 2026, a data breach allegedly containing data relating to Canada Goose customers was published publicly. The data contained 920k records with 582k unique email addresses and included names, phone numbers, IP addresses, physical addresses and partial credit card data, specifically card type and last 4 digits. Canada Goose advised that the data "appears to relate to past customer transactions" and stated t…

Device informationEmail addressesIP addressesNamesPartial credit card dataPhone numbersPhysical addressesPurchases

623.8K accounts upenn.edu · breached Oct 2025 · added Feb 16, 2026

University of Pennsylvania

In October 2025, the University of Pennsylvania was the victim of a data breach followed by a ransom demand, largely affecting its donor database. After the incident, the attackers sent inflammatory emails to some victims. The data was later published online in February 2026 and included 624k unique email addresses alongside names and physical addresses. For some donor records, additional personal information was ex…

Charitable donationsDates of birthEmail addressesGendersIncome levelsJob titlesNamesPhysical addressesReligionsSalutationsSpouses names

450.8K accounts apoia.se · breached Dec 2025 · added Feb 16, 2026

APOIA.se

In December 2025, a database of the Brazilian crowdfunding platform APOIA.se was posted to an online forum. In January 2026, the company confirmed it had suffered a data breach. The incident exposed 451k unique email addresses along with names and physical addresses.

Email addressesNamesPhysical addresses

1K accounts toybattles.net · breached Feb 2026 · added Feb 10, 2026

Toy Battles

In February 2026, the online gaming community Toy Battles suffered a data breach. The incident exposed 1k unique email addresses alongside usernames, IP addresses and chat logs. Following the breach, Toy Battles self-submitted the data to Have I Been Pwned.

Chat logsEmail addressesIP addressesUsernames

5.6K accounts anps.fr · breached Jan 2026 · added Feb 10, 2026

Association Nationale des Premiers Secours

In January 2026, a data breach impacting the French non-profit Association Nationale des Premiers Secours (ANPS) was posted to a hacking forum. The breach exposed 5.6k unique email addresses along with names, dates of birth and places of birth. ANPS self-submitted the data to HIBP and advised the incident was traced back to a legacy system and did not impact health data, financial information or passwords.

Dates of birthEmail addressesNamesPlaces of birthSalutations

663.1K accounts substack.com · breached Oct 2025 · added Feb 6, 2026

Substack

In October 2025, the publishing platform Substack suffered a data breach that was subsequently circulated more widely in February 2026. The breach exposed 663k account holder records containing email addresses along with publicly visible profile information from Substack accounts, such as publication names and bios. A subset of records also included phone numbers.

Email addressesPhone numbers

1.4M accounts betterment.com · breached Jan 2026 · added Feb 5, 2026

Betterment

In January 2026, the automated investment platform Betterment confirmed it had suffered a data breach attributed to a social engineering attack. As part of the incident, Betterment customers received fraudulent crypto-related messages promising high returns if funds were sent to an attacker-controlled cryptocurrency wallet. The breach exposed 1.4M unique email addresses, along with names and geographic location data…

Dates of birthDevice informationEmail addressesEmployersGeographic locationsJob titlesNamesPhone numbersPhysical addresses

5.1M accounts panerabread.com · breached Jan 2026 · added Jan 31, 2026

Panera Bread

In January 2026, Panera Bread suffered a data breach that exposed 14M records. After an attempted extortion failed, the attackers published the data publicly, which included 5.1M unique email addresses along with associated account information such as names, phone numbers and physical addresses. Panera Bread subsequently confirmed that "the data involved is contact information" and that authorities were notified.

Email addressesNamesPhone numbersPhysical addresses

29.8M accounts soundcloud.com · breached Dec 2025 · added Jan 27, 2026

SoundCloud

In December 2025, SoundCloud announced it had discovered unauthorised activity on its platform. The incident allowed an attacker to map publicly available SoundCloud profile data to email addresses for approximately 20% of its users. The impacted data included 30M unique email addresses, names, usernames, avatars, follower and following counts and, in some cases, the user’s country. The attackers later attempted to …

AvatarsEmail addressesGeographic locationsNamesProfile statisticsUsernames

72.7M accounts underarmour.com · breached Nov 2025 · added Jan 21, 2026

Under Armour

In November 2025, the Everest ransomware group claimed Under Armour as a victim and attempted to extort a ransom, alleging they had obtained access to 343GB of data. In January 2026, customer data from the incident was published publicly on a popular hacking forum, including 72M email addresses. Many records also contained additional personal information such as names, dates of birth, genders, geographic locations a…

Dates of birthEmail addressesGendersGeographic locationsNamesPurchases

10.2M accounts raaga.com · breached Dec 2025 · added Jan 19, 2026

Raaga

In December 2025, data allegedly breached from the Indian streaming music service "Raaga" was posted for sale to a popular hacking forum. The data contained 10M unique email addresses along with names, genders, ages (in some cases, full date of birth), postcodes and passwords stored as unsalted MD5 hashes.

AgesDates of birthEmail addressesGendersGeographic locationsNamesPasswords

6.4M accounts pass.sports.gouv.fr · breached Dec 2025 · added Jan 18, 2026

Pass'Sport

In December 2025, data from France's Pass'Sport program was posted to a popular hacking forum. Initially misattributed to CAF (the French family allowance fund), the data contained 6.5M unique email addresses affecting 3.5M households. The data also included names, phone numbers, genders and physical addresses. The Ministry of Sports subsequently released a statement acknowledging the incident.

Email addressesGendersNamesPhone numbersPhysical addresses

6.2M accounts instagram.com · breached Jan 2026 · added Jan 11, 2026

Instagram

In January 2026, data allegedly scraped via an Instagram API was posted to a popular hacking forum. The dataset contained 17M rows of public Instagram information, including usernames, display names, account IDs, and in some cases, geolocation data. Of these records, 6.2M included an associated email address, and some also contained a phone number. The scraped data appears to be unrelated to password reset requests …

Display namesEmail addressesGeographic locationsPhone numbersUsernames

672.2K accounts breachforums.hn · breached Aug 2025 · added Jan 10, 2026

BreachForums (2025)

In October 2025, a reincarnation of the hacking forum BreachForums, which had previously been shut down multiple times, was taken offline by a coalition of law enforcement agencies. In the months leading up to the takedown, the site itself suffered a data breach that exposed a total of 672k unique email addresses across all tables, including within forum posts and private messages. The users table alone contained 32…

Email addressesForum postsPasswordsPrivate messagesUsernames

2.4M accounts wired.com · breached Sep 2025 · added Dec 27, 2025

WIRED

In December 2025, 2.3M records of WIRED magazine users allegedly obtained from parent company Condé Nast were published online. The most recent data dated back to the previous September and exposed email addresses and display names, as well as, for a small number of users, their name, phone number, date of birth, gender, and geographic location or full physical address. The WIRED data allegedly represents a subset o…

Dates of birthDisplay namesEmail addressesGendersGeographic locationsNamesPhone numbersPhysical addresses

401.4K accounts utair.ru · breached Mar 2019 · added Dec 26, 2025

Utair

In August 2020, news broke of a data breach of Russian airline Utair that dated back to the previous year. The breach contained over 400k unique email addresses along with extensive personal information including names, physical addresses, dates of birth, passport numbers and loyalty program details.

Dates of birthEmail addressesGendersLoyalty program detailsNamesPassport numbersPhone numbersPhysical addresses

487.2K accounts autosur.fr · breached Mar 2025 · added Dec 18, 2025

AUTOSUR

In March 2025, the French vehicle inspection company AUTOSUR suffered a data breach exposing over 10M customer records, though only 487k unique email addresses were present. The compromised data included names, phone numbers, physical addresses, and vehicle details such as make and model, VIN, and registration plate. AUTOSUR later issued a disclosure notice with further details.

Email addressesNamesPhone numbersPhysical addressesVehicle detailsVehicle identification numbers (VINs)Vehicle registration plates

96.3K accounts thebotnet.com · breached Aug 2012 · added Dec 18, 2025

The Botting Network

In August 2012, the forum for making money with botting "The Botting Network" suffered a data breach that exposed 96k user records. The now defunct vBulletin forum leaked 96k email addresses, usernames, dates of birth and salted MD5 password hashes.

Dates of birthEmail addressesPasswordsUsernames

515.1K accounts webhostingtalk.com · breached Jul 2016 · added Dec 17, 2025

Web Hosting Talk

In July 2016, the Web Hosting Talk forum suffered a data breach that was subsequently listed for sale. The breach of the vBulletin based forum exposed 515k user records including usernames, email addresses, IP addresses and salted MD5 password hashes.

Email addressesIP addressesPasswordsUsernames

817.8K accounts kinokong.org · breached Mar 2021 · added Dec 6, 2025

KinoKong

In March 2021, the Russian online streaming service KinoKong suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed over 800k unique email addresses along with names, usernames, IP addresses and MD5 password hashes.

Email addressesIP addressesNamesPasswordsUsernames

287.9K accounts zilvia.net · breached Nov 2025 · added Dec 1, 2025

Zilvia.net

In November 2025, data breached from the Zilvia.net Nissan 240SX Silvia and Z Fairlady car forum was leaked. The breach exposed 288k unique email addresses along with usernames, IP addresses and salted MD5 password hashes sourced from the vBulletin based platform. Attempts to contact Zilvia.net about the incident were unsuccessful.

Email addressesIP addressesPasswordsUsernames

6.4M accounts csdn.net · breached Dec 2011 · added Nov 27, 2025

China Software Developer Network

In 2011, the China Software Developer Network (CSDN) suffered a data breach that exposed over 6M user records. The data included email addresses alongside usernames and plain text passwords.

Email addressesPasswordsUsernames

103.1K accounts codestepbystep.com · breached Nov 2025 · added Nov 23, 2025

CodeStepByStep

In November 2025, the online coding practice tool CodeStepByStep suffered a data breach that exposed 17k records which were subsequently published online. The following month, a further corpus of data was released bringing the total to 103k. The impacted data included names, usernames and email addresses.

Email addressesNamesUsernames

1.8M accounts adda.io · breached Mar 2025 · added Nov 23, 2025

ADDA

In March 2025, data allegedly breached from the ADDA housing societies service was posted to a public hacking forum. The data contained over 1.8M unique email addresses along with names, phone numbers and MD5 password hashes.

Email addressesNamesPasswordsPhone numbers

340.3K accounts ikointl.com · breached Nov 2025 · added Nov 20, 2025

International Kiteboarding Organization

In November 2025, the International Kiteboarding Organization suffered a data breach that exposed 340k user records. The data was subsequently listed for sale on a hacking forum and included email addresses, names, usernames and in many cases, the user's city and country.

Email addressesGeographic locationsNamesUsernames

1M accounts beckett.com · breached Nov 2025 · added Nov 20, 2025

Beckett Collectibles

In November 2025, Beckett Collectibles experienced a data breach accompanied by website content defacement. The stolen data was later advertised for sale on a prominent hacking forum, with portions subsequently released publicly. The publicly circulating data initially included more than 500k email addresses reportedly belonging to North American customers, before a larger corpus of over 1M addresses was published t…

Email addressesNamesPhone numbersPhysical addressesUsernames

10K accounts eurofiber.com · breached Nov 2025 · added Nov 20, 2025

Eurofiber

In November 2025, Eurofiber France disclosed a data breach of its ticket management platform. Data containing 10k unique email addresses and a smaller number of names and phone numbers was subsequently leaked. A threat actor claiming responsibility for the breach alleges to have additional, more sensitive data including screenshots, VPN configuration files, credentials, source code, certificates, archives, and SQL b…

Email addressesNamesPhone numbers

187.9K accounts vultr.com · breached Jul 2022 · added Nov 20, 2025

Vultr

In March 2023, the "AI-first global cloud platform" Vultr disclosed a security incident at a third-party vendor. Dating back to the previous year, the incident was attributed to the ActiveCampaign email marketing service provider and resulted in the exposure of 188k unique email addresses. A small number of records also included name, IP address and country of origin. No Vultr systems or additional customer data wer…

Email addressesGeographic locationsIP addressesNames

2M accounts breached Nov 2025 · added Nov 13, 2025 Malware logs

Operation Endgame 3.0

Between 10 and 13 November 2025, the latest phase of Operation Endgame was coordinated from Europol's headquarters in The Hague. The actions targeted one of the biggest infostealer Rhadamanthys, the Remote Access Trojan VenomRAT, and the botnet Elysium, all of which played a key role in international cybercrime. Authorities took down these three large cybercrime enablers and provided 2 million impacted email address…

Email addressesPasswords

2B accounts breached Apr 2025 · added Nov 6, 2025

Synthient Credential Stuffing Threat Data

During 2025, the threat-intelligence firm Synthient aggregated 2 billion unique email addresses disclosed in credential-stuffing lists found across multiple malicious internet sources. Comprised of email addresses and passwords from previous data breaches, these lists are used by attackers to compromise other, unrelated accounts of victims who have reused their passwords. The data also included 1.3 billion unique pa…