Data Breaches

Check your email or password

Find out whether your email address or a password are leaked somewhere.

Check your email address or password…

  1. Unverified Data Source

    astoriacompany.com
    11.5Maccounts
    Breached Disclosed
    Have I Been Pwned Unverified
    • Bank account numbers
    • Credit status information
    • Dates of birth
    • Email addresses
    • Employers
    • Health insurance information
    • Income levels
    • +7 more
    In January 2021, over 11M unique email addresses were discovered by Night Lion Security alongside an extensive amount of personal information including names, physical and IP addresses, phone numbers and dates of birth. Some records also contained social security numbers, driver's license details, personal financial information and health-related data, depending on where the information was sourced from. Initially attributed to Astoria Company, they subsequently investigated the incident and confirmed the data did not originate from their services.

  2. Carding Mafia (March 2021)

    cardmafia.cc
    297.7Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified Sensitive
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In March 2021, the Carding Mafia forum suffered a data breach that exposed almost 300k members' email addresses. Dedicated to the theft and trading of stolen credit cards, the forum breach also exposed usernames, IP addresses and passwords stored as salted MD5 hashes.

  3. WeLeakInfo

    weleakinfo.com
    11.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified Sensitive
    • Browser user agent details
    • Email addresses
    • Employers
    • IP addresses
    • Names
    • Partial credit card data
    • Physical addresses
    • +1 more
    In March 2021, the Stripe account of the now-defunct WeLeakInfo service was taken over by "pompompurin" after acquiring an expired domain name with an email address used to manage the account. Access to Stripe then exposed almost 12k unique email addresses from customers who'd made credit card payments in order to obtain breached data hosted by WeLeakInfo. The data was subsequently leaked publicly and also included names, payment histories, IP addresses, billing addresses, partial credit card data and the organisation making the purchase.

  4. Liker

    liker.com
    465.1Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Auth tokens
    • Dates of birth
    • Education levels
    • Email addresses
    • Geographic locations
    • IP addresses
    • Names
    • +6 more
    In March 2021, the self-proclaimed "kinder, smarter social network" Liker suffered a data breach, allegedly in retaliation for the Gab data breach and scraping of data from Parler. The site remained offline after the breach which exposed 465k email addresses in addition to names, dates of birth, education levels, private messages, security questions and answers in plain text, passwords stored as bcrypt hashes and other personal data attributes. Liker did not respond when contacted about the breach.

  5. Travel Oklahoma

    travelok.com
    637.3Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Age groups
    • Dates of birth
    • Email addresses
    • Genders
    • Names
    • Physical addresses
    In December 2020, the Oklahoma state Tourism and Recreation Department suffered a data breach. The incident exposed 637k email addresses across a variety of tables including age ranges against brochure orders and dates of birth against contest entries. Genders, names and physical addresses were also exposed.

  6. Gab

    gab.com
    66.5Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified Sensitive
    • Avatars
    • Email addresses
    • Names
    • Passwords
    • Private messages
    • Usernames
    In February 2021, the alt-tech social network service Gab suffered a data breach. The incident exposed almost 70GB of data including 4M user accounts, a small number of private chat logs and a list of public groups and public posts made to the service. Only a small number of accounts included email addresses and / or passwords stored as bcrypt hashes with a total of 66.5k unique email addresses being exposed across the corpus of data.

  7. Oxfam

    oxfam.org.au
    1.8Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Bank account numbers
    • Dates of birth
    • Email addresses
    • Genders
    • Names
    • Partial credit card data
    • Payment histories
    • +2 more
    In January 2021, Oxfam Australia was the victim of a data breach which exposed 1.8M unique email addresses of supporters of the charity. The data was put up for sale on a popular hacking forum and also included names, phone numbers, addresses, genders and dates of birth. A small number of people also had partial credit card data exposed (the first 6 and last 3 digits of the card, plus card type and expiry) and in some cases the bank name, account number and BSB were also exposed. The data was subsequently made freely available on the hacking forum later the following month.

  8. Ticketcounter

    ticketcounter.nl
    1.9Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Bank account numbers
    • Dates of birth
    • Email addresses
    • Genders
    • IP addresses
    • Names
    • Payment histories
    • +2 more
    In August 2020, the Dutch ticketing service Ticketcounter inadvertently published a database backup to a publicly accessible location where it was then found and downloaded in February 2021. The data contained 1.9M unique email addresses which were offered for sale on a hacking forum and in some cases included names, physical and IP addresses, genders, dates of birth, payment histories and bank account numbers. Ticketcounter was later held to ransom with the threat of the breached being released publicly.

  9. SuperVPN & GeckoVPN

    20.3Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Device information
    • Device serial numbers
    • Email addresses
    • Geographic locations
    • IMSI numbers
    • Login histories
    In February 2021, a series of "free" VPN services were breached including SuperVPN and GeckoVPN, exposing over 20M records. The data appeared together in a single file with a small number of records also included from FlashVPN, suggesting that all three brands may share the same platform. Impacted data also included email addresses, the country logged in from and the date and time each login occurred alongside device information including the make and model, IMSI number and serial number.

  10. Filmai.in

    filmai.in
    645.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Usernames
    In approximately 2019 or 2020, the Lithuanian movie streaming service Filmai.in suffered a data breach exposing 645k email addresses, usernames and plain text passwords.

  11. NurseryCam

    nurserycam.co.uk
    10.6Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    In February 2021, a series of egregiously bad security flaws were identified in the NurseryCam system designed for parents to remotely monitor their children whilst attending nursery. The flaws led to the exposure of over 10k parent records before the service was shut down. The email addresses alone were provided to Have I Been Pwned to ensure parents were properly notified of the incident.

  12. People's Energy

    peoplesenergy.co.uk
    358.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    In December 2020, the UK power company People's Energy suffered a data breach. The breach exposed almost 7GB of files containing 359k unique email addresses along with names, phones numbers, physical addresses and dates of birth. The incident also included People's Energy staff email addresses and bcrypt password hashes (no customer passwords were exposed).

  13. NetGalley

    netgalley.com
    1.4Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • IP addresses
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    • +1 more
    In December 2020, the book promotion site NetGalley suffered a data breach. The incident exposed 1.4 million unique email addresses alongside names, usernames, physical and IP addresses, phone numbers, dates of birth and passwords stored as salted SHA-1 hashes.

  15. Ge.tt

    ge.tt
    2.5Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    • Social media profiles
    In May 2017, the file sharing platform Ge.tt suffered a data breach. The data was subsequently put up for sale on a dark web marketplace in February 2019 alongside a raft of other breaches. The Ge.tt breach included names, social media profile identifiers, SHA256 password hashes and almost 2.5M unique email addresses.

  16. StoryBird

    storybird.com
    1Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    • Usernames
    In August 2015, the storytelling service StoryBird suffered a data breach exposing 4 million records with 1 million unique email addresses. Impacted data also included names, usernames and passwords stored as PBKDF2 hashes. The data was provided to HIBP by dehashed.com.

  17. Pixlr

    pixlr.com
    1.9Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Geographic locations
    • Names
    • Passwords
    • Social media profiles
    In October 2020, the online photo editing application Pixlr suffered a data breach exposing 1.9 million subscribers. Impacted data included names, email addresses, social media profiles, the country signed up from and passwords stored as SHA-512 hashes. The data was provided to HIBP by dehashed.com.

  18. MeetMindful

    meetmindful.com
    1.4Maccounts
    Breached Disclosed
    Have I Been Pwned Verified Sensitive
    • Dates of birth
    • Drinking habits
    • Drug habits
    • Email addresses
    • Genders
    • Geographic locations
    • IP addresses
    • +9 more
    In early 2020, the online dating service MeetMindful suffered a data breach that exposed 1.4 million unique customer email addresses. Included in the data was an extensive array of personal information used to find romantic matches including physical attributes, use of alcohol, drugs and cigarettes, marital statuses, birthdates, genders and the gender being sought. Additional personal information such as names, geographical locations and IP addresses were also exposed, along with passwords stored as bcrypt hashes.

  19. Bonobos

    bonobos.com
    2.8Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Historical passwords
    • IP addresses
    • Names
    • Partial credit card data
    • Passwords
    • Phone numbers
    • +2 more
    In August 2020, the clothing store Bonobos suffered a data breach that exposed almost 70GB of data containing 2.8 million unique email addresses. The breach also exposed names, physical and IP addresses, phone numbers, order histories and passwords stored as salted SHA-512 hashes, including historical passwords. The breach also exposed partial credit card data including card type, the name on the card, expiry date and the last 4 digits of the card. The data was provided to HIBP by dehashed.com.

  21. Romwe

    romwe.com
    19.5Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Geographic locations
    • IP addresses
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    In mid-2018, the Hong Kong-based retailer Romwe suffered a data breach which exposed almost 20 million customers. The data was subsequently sold online and includes names, phone numbers, email and IP addresses, customer geographic locations and passwords stored as salted SHA-1 hashes. The data was provided to HIBP by dehashed.com.

  23. Glofox

    glofox.com
    2.3Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Genders
    • Names
    • Passwords
    • Phone numbers
    In March 2020, the Irish gym management software company Glofox suffered a data breach which exposed 2.3M membership records. The data included email addresses, names, phone numbers, genders, dates of birth and passwords stored as unsalted MD5 hashes.

  24. GeniusU

    geniusu.com
    1.3Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Genders
    • IP addresses
    • Names
    • Passwords
    • Social media profiles
    In November 2020, a collection of data breaches were made public including the "Entrepreneur Success Platform", GeniusU. Dating back to the previous month, the data included 1.3M names, email and IP addresses, genders, links to social media profiles and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.

Breach records: Have I Been Pwned (CC BY 4.0), the HHS OCR breach portal, the Washington State Attorney General and the California Attorney General breach registers (public records). Last synced 2 hours ago.