Data Breaches

Check your email or password

Find out whether your email address or a password are leaked somewhere.

Check your email address or password…

  1. Campbell University

    NC, US · Healthcare Provider · Hacking/IT Incident
    500people
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  2. United Medical Doctors

    CA, US · Healthcare Provider · Hacking/IT Incident
    501people
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  3. Charter

    charter.com
    4.9Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Job titles
    • Names
    • Phone numbers
    • Physical addresses
    In May 2026, the telecommunications company Charter Communications (the parent company behind the consumer broadband and cable brand Spectrum) was named by the ShinyHunters group in a "pay or leak" extortion campaign. The group later published the data, which exposed 4.9M unique email addresses along with names, phone numbers and physical addresses. A subset of approximately 85k records originating from an internal employee directory also included job titles. Charter confirmed the incident, but stated that no sensitive personal information or customer proprietary network information (CPNI) was exfiltrated.

  4. Kannarr Eye Care

    KS, US · Healthcare Provider · Hacking/IT Incident
    14Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  5. Texas Capital

    WA, US
    5.1Kpeople
    Breached Disclosed
    Washington State AG Official register
    • Name
    • Social Security Number
    • Full Date of Birth

  6. Kemper

    kemper.com
    269.3Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Partial credit card data
    • Phone numbers
    • Physical addresses
    • Purchases
    In April 2026, the American insurance holding company Kemper Corporation was named by the ShinyHunters ransomware group in a "pay or leak" extortion campaign. The attackers allegedly accessed Kemper's Salesforce environment via social engineering as part of a broader campaign targeting hundreds of organisations using the same method. The group later published tens of gigabytes of data they claimed included internal directory data, Salesforce records and Stripe payment logs. Among the 269k unique email addresses were names, phone numbers, physical addresses and partial payment card data including the last 4 digits, expiry dates and card brands. Kemper confirmed the incident and stated they had engaged third-party cybersecurity experts and notified law enforcement.

  7. Carnival Corporation

    WA, US
    55Kpeople
    Breached Disclosed
    Washington State AG Official register
    • Name
    • Driver's License or Washington ID Card Number
    • Full Date of Birth
    • Passport Number

  9. Mytheresa

    mytheresa.com
    84.1Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Partial credit card data
    • Phone numbers
    • Physical addresses
    • Purchases
    • Salutations
    In April 2026, the luxury fashion e-commerce platform Mytheresa was listed as a victim of the ShinyHunters "pay or leak" extortion group. After the ransom deadline passed, the group publicly released the data which contained 84k unique email addresses. The exposed data also included names, phone numbers, physical addresses, purchases and partial credit card data including card type, last 4 digits and expiry date.

  10. Ameriprise

    ameriprise.com
    502.6Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Employers
    • Financial transactions
    • Job titles
    • Names
    • Phone numbers
    • Physical addresses
    In March 2026, the financial services firm Ameriprise Financial was named by the ShinyHunters group in a "pay or leak" extortion campaign. The group claimed possession of more than 200GB of compressed data exfiltrated from Ameriprise's Salesforce environment and internal SharePoint infrastructure, and subsequently published the data after negotiations allegedly failed. The published data contained 500k unique email addresses as well as names, phone numbers, physical addresses and employer information. In their disclosure to state attorneys general, Ameriprise reported 47,876 affected people; the larger email address population represents contacts from Ameriprise's broader operational systems, including internal staff. Ameriprise further advised that they have "implemented heightened monitoring of your account(s) to include enhanced identity verification procedures".

  11. Spokane Digestive Disease Center, P.S.

    WA, US
    2.1Kpeople
    Breached Disclosed
    Washington State AG Official register
    • Name
    • Social Security Number
    • Driver's License or Washington ID Card Number
    • Financial & Banking Information
    • Full Date of Birth
    • Medical Information

  12. University of St. Thomas-Houston

    WA, US
    516people
    Breached Disclosed
    Washington State AG Official register
    • Name
    • Social Security Number
    • Driver's License or Washington ID Card Number
    • Financial & Banking Information
    • Full Date of Birth
    • Student ID Number
    • Passport Number
    • +2 more

  13. ERMI LLC

    GA, US · Healthcare Provider · Hacking/IT Incident
    74.1Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Email

  14. 7-Eleven

    7-eleven.com
    185.3Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Names
    • Phone numbers
    • Physical addresses
    In April 2026, 7-Eleven was the victim of a "pay or leak" extortion campaign by ShinyHunters, with the data later published that month. The incident exposed 185k unique email addresses, along with names, physical addresses, dates of birth and phone numbers. A small number of records also contained additional exposed data fields. The company later advised the breach was limited to "certain 7-Eleven systems used to store franchisee documents", a statement consistent with the exposed data.

  15. Virta Medical PC

    CO, US · Healthcare Provider · Hacking/IT Incident
    14.6Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  16. Gastro Health

    WA, US
    1.8Kpeople
    Breached Disclosed
    Washington State AG Official register
    • Name
    • Social Security Number
    • Driver's License or Washington ID Card Number
    • Full Date of Birth
    • Health Insurance Policy or ID Number
    • Medical Information
    • Protected Health Information owned or licensed by a HIPAA covered entity

  17. AUTOAPS LLC

    CA, US · Business Associate · Hacking/IT Incident
    1.6Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  18. Gastro Health

    FL, US · Healthcare Provider · Hacking/IT Incident
    35.6Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Email

  19. South Florida Injury Centers, Inc.

    FL, US · Healthcare Provider · Hacking/IT Incident
    1.5Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  20. Acadia Healthcare Company, Inc

    TN, US · Business Associate · Hacking/IT Incident
    1.8Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Email

  23. Nottingham Village

    PA, US · Healthcare Provider · Hacking/IT Incident
    5.2Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  24. Barnhart Crane & Rigging Company, Inc.

    WA, US
    1.1Kpeople
    Breached Disclosed
    Washington State AG Official register
    • Name
    • Social Security Number
    • Driver's License or Washington ID Card Number
    • Financial & Banking Information
    • Full Date of Birth
    • Passport Number
    • Health Insurance Policy or ID Number
    • +1 more

Breach records: Have I Been Pwned (CC BY 4.0), the HHS OCR breach portal, the Washington State Attorney General and the California Attorney General breach registers (public records). Last synced 9 hours ago.