Data Breaches

Check your email or password

Find out whether your email address or a password are leaked somewhere.

Check your email address or password…

  1. GameSprite

    gamesprite.me
    6.2Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In December 2019, the now defunct gaming platform GameSprite suffered a data breach that exposed over 6M unique email addresses. The impacted data also included usernames, IP addresses and salted MD5 password hashes.

  2. MemeChat

    memechat.app
    4.3Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Usernames
    In mid-2022, "the ultimate hub of memes" MemeChat suffered a data breach that exposed 7.4M records. Alleged to be due to a misconfigured Elasticsearch instance, the data contained 4.3M unique email addresses alongside usernames.

  3. Toumei

    toumei.co.jp
    76.7Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Phone numbers
    • Physical addresses
    In October 2023, the Japanese consultancy firm Toumei suffered a data breach. The breach exposed over 100M lines and 10GB of data including 77k unique email addresses along with names, phone numbers and physical addresses.

  4. Tunngle

    tunngle.net
    8.2Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In 2016, the now defunct global LAN gaming network Tunngle suffered a data breach that exposed 8.2M unique email addresses. The compromised data also included usernames, IP addresses and passwords stored as salted MD5 hashes.

  6. AndroidLista

    androidlista.com
    6.6Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    • Usernames
    In July 2021, the Android applications and games review site AndroidLista suffered a data breach. The incident exposed 6.6M user records containing email addresses, names, usernames and passwords stored as salted SHA-1 hashes, all of which were subsequently posted to a popular hacking forum. AndroidLista did not respond when contacted about the breach.

  7. Phoenix

    phoenixim.ddns.net
    74.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In mid-2021, the "vintage messaging reborn" service Phoenix suffered a data breach that exposed 75k unique email addresses. The breach also exposed IP addresses, usernames and passwords.

  9. Public Business Data

    bvdinfo.com
    27.9Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Job titles
    • Names
    • Phone numbers
    • Physical addresses
    In approximately August 2021, hundreds of gigabytes of business data collated from public sources was obtained and later published to a popular hacking forum. Sourced from a customer of Bureau van Dijk's (BvD) "Orbis" product, the corpus of data released contained hundreds of millions of lines about corporations and individuals, including personal information such as names and dates of birth. The data also included 28M unique email addresses along with physical addresses (presumedly corporate locations), phone numbers and job titles. There was no unauthorised access to BvD's systems, nor did the incident expose any of their or parent company's Moody's clients.

  10. PaySystem.tech

    paysystem.tech
    1.4Maccounts
    Breached Disclosed
    Have I Been Pwned Unverified
    • Credit cards
    • Email addresses
    • Purchases
    In mid-2022, data alleged to have been sourced from the Russian payment provider PaySystem.tech appeared in hacking circles where it was made publicly available for download. Consisting of 16M rows with 1.4M unique email addresses, the data also included purchases and full credit card numbers and expiry dates. The data could not be independently attributed back to PaySystem.tech and the breach has been flagged as "unverified".

  12. Activision

    activision.com
    16Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Geographic locations
    • Job titles
    • Names
    • Phone numbers
    In December 2022, attackers socially engineered an Activision HR employee into disclosing information which led to the breach of almost 20k employee records. The data contained 16k unique email addresses along with names, phone numbers, job titles and the office location of the employee. Activision advised that no sensitive employee information was included in the breach.

  13. Horse Isle

    horseisle.com
    27.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Genders
    • IP addresses
    • Names
    • Passwords
    • Purchases
    • Usernames
    In June 2020 then again in September that same year, Horse Isle "The Secrent Land of Horses" suffered a data breach. The incident exposed 28k unique email addresses along with names, usernames, IP addresses, genders, purchases and plain text passwords. The system also stored and exposed failed password attempts for each user with the password retained in plain text.

  15. MalindoAir

    malindoair.com
    4.3Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Genders
    • Loyalty program details
    • Names
    • Nationalities
    • Passport numbers
    • +3 more
    In early 2019, the Malaysian airline Malindo Air suffered a data breach that exposed tens of millions of customer records. Containing 4.3M unique email addresses, the breach also exposed extensive personal information including names, dates of birth, genders, physical addresses, phone numbers and passport details. The data was later extensively shared on popular hacking forums.

  16. Viva Air

    vivaair.com
    932.2Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Names
    • Partial credit card data
    • Phone numbers
    • Physical addresses
    • Purchases
    In March 2022, the now defunct Colombian airline Viva Air suffered a data breach and subsequent ransomware attack. Among a trove of other ransomed data, the incident exposed a log of 2.6M transactions with 932k unique email addresses, physical and IP addresses, names, phone numbers and partial credit card data (last 4 digits).

  17. Dymocks

    dymocks.com.au
    836.1Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Genders
    • Names
    • Phone numbers
    • Physical addresses
    In September 2023, the Australian book retailer Dymocks announced a data breach. The data dated back to June 2023 and contained 1.2M records with 836k unique email addresses. The breach also exposed names, dates of birth, genders, phone numbers and physical addresses.

  19. Pampling

    pampling.com
    383.5Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    • Usernames
    In January 2020, the online clothing retailer Pampling suffered a data breach that exposed 383k unique customer email addresses. The data was later shared on a popular hacking forum and also included names, usernames and unsalted MD5 password hashes.

  20. PlayCyberGames

    playcybergames.com
    3.7Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Usernames
    In August 2023, PlayCyberGames which "allows users to play any games with LAN function or games using IP address" suffered a data breach which exposed 3.7M customer records. The data included email addresses, usernames and MD5 password hashes with a constant value in the "salt" field. PlayCyberGames did not respond to multiple attempts to disclose the breach.

  22. Duolingo

    duolingo.com
    2.7Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Spoken languages
    • Usernames
    In August 2023, 2.6M records of data scraped from Duolingo were broadly distributed on a popular hacking forum. Obtained by enumerating a vulnerable API, the data had earlier appeared for sale in January 2023 and contained email addresses, names, the languages being learned, XP (experience points), and other data related to learning progress on Duolingo. Whilst some of the data attributes are intentionally public, the ability to map private email addresses to them presents an ongoing risk to user privacy.

  24. ECCIE

    eccie.net
    536.9Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified Sensitive
    • Dates of birth
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In January 2021, the adult escort forum ECCIE suffered a data breach which was later posted to a popular hacking forum. The data included 536k user records with email and IP addresses, usernames, dates of birth and salted MD5 password hashes.

Breach records: Have I Been Pwned (CC BY 4.0), the HHS OCR breach portal, the Washington State Attorney General and the California Attorney General breach registers (public records). Last synced 7 hours ago.