Data Breaches

Check your email or password

Find out whether your email address or a password are leaked somewhere.

Check your email address or password…

  1. Builders FirstSource Flex Plan

    TX, US · Health Plan · Hacking/IT Incident
    1.5Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  3. Figure

    figure.com
    967.2Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Names
    • Phone numbers
    • Physical addresses
    In February 2026, data obtained from the fintech lending platform Figure was publicly posted online. The exposed data, dating back to January 2026, contained over 900k unique email addresses along with names, phone numbers, physical addresses and dates of birth. Figure confirmed the incident and attributed it to a social engineering attack in which an employee was tricked into providing access.

  4. Emanuel Medical Center

    GA, US · Healthcare Provider · Hacking/IT Incident
    29Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  5. Canada Goose

    canadagoose.com
    581.9Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Device information
    • Email addresses
    • IP addresses
    • Names
    • Partial credit card data
    • Phone numbers
    • Physical addresses
    • +1 more
    In February 2026, a data breach allegedly containing data relating to Canada Goose customers was published publicly. The data contained 920k records with 582k unique email addresses and included names, phone numbers, IP addresses, physical addresses and partial credit card data, specifically card type and last 4 digits. Canada Goose advised that the data "appears to relate to past customer transactions" and stated that it originated from a breach at a third party in August 2025. The most recent transaction date in the data is July 2025.

  6. University of Pennsylvania

    upenn.edu
    623.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Charitable donations
    • Dates of birth
    • Email addresses
    • Genders
    • Income levels
    • Job titles
    • Names
    • +4 more
    In October 2025, the University of Pennsylvania was the victim of a data breach followed by a ransom demand, largely affecting its donor database. After the incident, the attackers sent inflammatory emails to some victims. The data was later published online in February 2026 and included 624k unique email addresses alongside names and physical addresses. For some donor records, additional personal information was exposed, including gender and date of birth. A small subset of records also contained religion, spouse name, estimated income and donation history.

  7. 44North

    MI, US · Business Associate · Hacking/IT Incident
    2.2Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Email

  8. Easterseals Northeast Indiana

    IN, US · Healthcare Provider · Hacking/IT Incident
    3.2Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  9. APOIA.se

    apoia.se
    450.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Physical addresses
    In December 2025, a database of the Brazilian crowdfunding platform APOIA.se was posted to an online forum. In January 2026, the company confirmed it had suffered a data breach. The incident exposed 451k unique email addresses along with names and physical addresses.

  10. Wee Care Pediatrics, LLC

    UT, US · Healthcare Provider · Hacking/IT Incident
    2.1Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  11. Resource Corporation of America

    TX, US · Business Associate · Hacking/IT Incident
    501people
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  12. Cedar Valley Services

    MN, US · Healthcare Provider · Hacking/IT Incident
    501people
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  14. VPS Medical PLLC

    PA, US · Healthcare Provider · Hacking/IT Incident
    4.6Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  16. Cedar Point Health, LLC

    CO, US · Healthcare Provider · Hacking/IT Incident
    23.1Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  17. Toy Battles

    toybattles.net
    1Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Chat logs
    • Email addresses
    • IP addresses
    • Usernames
    In February 2026, the online gaming community Toy Battles suffered a data breach. The incident exposed 1k unique email addresses alongside usernames, IP addresses and chat logs. Following the breach, Toy Battles self-submitted the data to Have I Been Pwned.

  18. Association Nationale des Premiers Secours

    anps.fr
    5.6Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Names
    • Places of birth
    • Salutations
    In January 2026, a data breach impacting the French non-profit Association Nationale des Premiers Secours (ANPS) was posted to a hacking forum. The breach exposed 5.6k unique email addresses along with names, dates of birth and places of birth. ANPS self-submitted the data to HIBP and advised the incident was traced back to a legacy system and did not impact health data, financial information or passwords.

  19. Carolina Foot & Ankle Associates

    NC, US · Healthcare Provider · Hacking/IT Incident
    501people
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  20. Wendy Foster OD

    KS, US · Healthcare Provider · Hacking/IT Incident
    20Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  22. Substack

    substack.com
    663.1Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Phone numbers
    In October 2025, the publishing platform Substack suffered a data breach that was subsequently circulated more widely in February 2026. The breach exposed 663k account holder records containing email addresses along with publicly visible profile information from Substack accounts, such as publication names and bios. A subset of records also included phone numbers.

  23. Cottage Hospital

    NH, US · Healthcare Provider · Hacking/IT Incident
    37.8Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Network Server

  24. Triad Radiology Associates

    NC, US · Healthcare Provider · Hacking/IT Incident
    11Kpeople
    Disclosed
    HHS OCR breach portal Official register
    • Email

Breach records: Have I Been Pwned (CC BY 4.0), the HHS OCR breach portal, the Washington State Attorney General and the California Attorney General breach registers (public records). Last synced 3 hours ago.