Data Breaches

Check your email or password

Find out whether your email address or a password are leaked somewhere.

Check your email address or password…

  1. Ledger

    ledger.com
    1.1Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Phone numbers
    • Physical addresses
    In June 2020, the hardware crypto wallet manufacturer Ledger suffered a data breach that exposed over 1 million email addresses. The data was initially sold before being dumped publicly in December 2020 and included names, physical addresses and phone numbers. The data was provided to HIBP by Alon Gal, CTO of cybercrime intelligence firm Hudson Rock.

  2. Peatix

    peatix.com
    4.2Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    In January 2019, the event organising platform Peatix suffered a data breach. The incident exposed 4.2M email addresses, names and salted password hashes. The data was provided to HIBP by dehashed.com.

  3. Pluto TV

    pluto.tv
    3.2Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Device information
    • Email addresses
    • Genders
    • IP addresses
    • Names
    • Passwords
    • +2 more
    In October 2018, the internet television service Pluto TV suffered a data breach which was then shared extensively in hacking communities. Pluto TV "decided not to proactively inform users of the breach" which contained 3.2M unique email and IP addresses, names, usernames, genders, dates of birth and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.

  4. Cit0day

    cit0day.in
    226.9Maccounts
    Breached Disclosed
    Have I Been Pwned Unverified
    • Email addresses
    • Passwords
    In November 2020, a collection of more than 23,000 allegedly breached websites known as Cit0day were made available for download on several hacking forums. The data consisted of 226M unique email address alongside password pairs, often represented as both password hashes and the cracked, plain text versions. Independent verification of the data established it contains many legitimate, previously undisclosed breaches. The data was provided to HIBP by dehashed.com.

  5. 123RF

    123rf.com
    8.7Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    • Usernames
    In March 2020, the stock photo site 123RF suffered a data breach which impacted over 8 million subscribers and was subsequently sold online. The breach included email, IP and physical addresses, names, phone numbers and passwords stored as MD5 hashes. The data was provided to HIBP by dehashed.com.

  6. Home Chef

    homechef.com
    8.8Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Geographic locations
    • IP addresses
    • Names
    • Partial credit card data
    • Passwords
    • Phone numbers
    In early 2020, the food delivery service Home Chef suffered a data breach which was subsequently sold online. The breach exposed the personal information of almost 9 million customers including names, IP addresses, post codes, the last 4 digits of credit card numbers and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.

  7. Animal Jam

    animaljam.com
    7.1Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Genders
    • IP addresses
    • Names
    • Passwords
    • Physical addresses
    • +1 more
    In October 2020, the online game for kids Animal Jam suffered a data breach which was subsequently shared through online hacking communities the following month. The data contained 46 million user accounts with over 7 million unique email addresses. Impacted data also included usernames, IP addresses and for some records, dates of birth (sometimes in partial form), physical addresses, parent names and passwords stored as PBKDF2 hashes.

  8. Mashable

    mashable.com
    1.4Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Auth tokens
    • Email addresses
    • Genders
    • Geographic locations
    • IP addresses
    • Names
    • Partial dates of birth
    • +1 more
    In approximately mid-2020, Mashable suffered a data breach that subsequently turned up publicly in November 2020. The data included 1.4 million unique email addresses along with names, genders, expired auth tokens, physical locations, links to social media profiles and days and months of birth. The data was provided to HIBP by dehashed.com.

  9. Lazada RedMart

    redmart.lazada.sg
    1.1Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Partial credit card data
    • Passwords
    • Phone numbers
    • Physical addresses
    In October 2020, news broke of Lazada RedMart data breach containing records as recent as July 2020 and being sold via an online marketplace. In all, the data contained 1.1 million customer email addresses alongside names, phone numbers, physical addresses, partial credit card numbers and passwords stored as SHA-1 hashes.

  10. James

    jamesdelivery.com.br
    1.5Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Geographic locations
    • Latitude and longitude pairs
    • Passwords
    In June 2020, 14 previously undisclosed data breaches appeared for sale including the Brazilian delivery service, "James". The breach occurred in March 2020 and exposed 1.5M unique email addresses, customer locations expressed in longitude and latitude and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.

  11. Wongnai

    wongnai.com
    3.9Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Geographic locations
    • IP addresses
    • Names
    • Passwords
    • Phone numbers
    • +1 more
    In October 2020, 17 previously undisclosed data breaches appeared for sale including the Thai restaurant, hotel and attraction finding service, Wongnai. The breach exposed almost 4M unique customer records from some time during 2020 along with names, phone numbers, links to social media profiles and passwords stored as MD5 hashes. The data was self-submitted to HIBP by Wongnai.

  12. Minted

    minted.com
    4.4Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    In May 2020, the online marketplace for independent artists Minted suffered a data breach that exposed 4.4M unique customer records subsequently sold on a dark web marketplace. Exposed data also included names, physical addresses, phone numbers and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.

  14. StarTribune

    startribune.com
    2.2Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Genders
    • Names
    • Passwords
    • Physical addresses
    • Usernames
    In October 2019, the Minnesota-based news service StarTribune suffered a data breach which was subsequently sold on the dark web. The breach exposed over 2 million unique email addresses alongside names, usernames, physical addresses, dates of birth, genders and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.

  15. Reincubate

    reincubate.com
    616.1Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    In October 2020, the app data company Reincubate suffered a data breach which exposed a backup from November 2017 (the newest record in the data appeared several months earlier). The data included over 616k unique email addresses, names and passwords stored as PBKDF2 hashes.

  17. WiziShop

    wizishop.fr
    2.9Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • IP addresses
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    In July 2020, the French e-commerce platform WiziShop suffered a data breach. The breach exposed 18GB worth of data including names, phone numbers, dates of birth, physical and IP addresses, SHA-1 password hashes and almost 3 million unique email addresses.

  18. Experian (South Africa)

    1.3Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Employers
    • Government issued IDs
    • Names
    • Occupations
    • Phone numbers
    In August 2020, Experian South Africa suffered a data breach which exposed the personal information of tens of millions of individuals. Only 1.3M of the records contained email addresses, whilst most contained government issued identity numbers, names, addresses, occupations and employers, amongst other person information.

  19. LiveAuctioneers

    liveauctioneers.com
    3.4Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    • Usernames
    In June 2020, the online antiques marketplace LiveAuctioneers suffered a data breach which was subsequently sold online then extensively redistributed in the hacking community. The data contained 3.4 million records including names, email and IP addresses, physical addresses, phones numbers and passwords stored as unsalted MD5 hashes.

  21. Utah Gun Exchange

    utahgunexchange.com
    235.2Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Genders
    • IP addresses
    • Passwords
    • Usernames
    In July 2020, the Utah Gun Exchange website suffered a data breach which included several other associated websites. In total, 235k unique email addresses were exposed before being traded online alongside names, usernames, genders, IP addresses and password hashes.

  22. Catho

    catho.com.br
    1.2Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    • Usernames
    In approximately March 2020, the Brazilian recruitment website Catho was compromised and subsequently appeared alongside 20 other breached websites listed for sale on a dark web marketplace. The breach included almost 11 million records with 1.2 million unique email addresses. Names, usernames and plain text passwords were also exposed.

  23. Sonicbids

    sonicbids.com
    751.7Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    • Usernames
    In December 2019, the booking website Sonicbids suffered a data breach which they attributed to "a data privacy event involving our third-party cloud hosting services". The breach contained 752k user records including names and usernames, email addresses and passwords stored as PBKDF2 hashes.

  24. Zoosk (2020)

    zoosk.com
    23.9Maccounts
    Breached Disclosed
    Have I Been Pwned Verified Sensitive
    • Dates of birth
    • Drinking habits
    • Education levels
    • Email addresses
    • Ethnicities
    • Family structure
    • Genders
    • +10 more
    In January 2020, the online dating service Zoosk suffered a data breach which was subsequently shared extensively across online hacking communities. The breach contained 24 million unique email addresses alongside extensive personal information including genders, sexualities, dates of birth, physical attributes such as height and weight, religions, ethnicities and political views. The breach also allegedly exposed MD5 password hashes, although the data circulating in hacking circles had this field nulled out.

Breach records: Have I Been Pwned (CC BY 4.0), the HHS OCR breach portal, the Washington State Attorney General and the California Attorney General breach registers (public records). Last synced 2 hours ago.