Data Breaches

Check your email or password

Find out whether your email address or a password are leaked somewhere.

Check your email address or password…

  3. Nulled.ch

    nulled.ch
    43.5Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Private messages
    • Usernames
    In May 2020, the hacking forum Nulled.ch was breached and the data published to a rival hacking forum. Over 43k records were compromised and included IP and email addresses, usernames and passwords stored as salted MD5 hashes alongside the private message history of the website's admin.

  4. Covve

    covve.com
    22.8Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Job titles
    • Names
    • Phone numbers
    • Physical addresses
    • Social media profiles
    In February 2020, a massive trove of personal information referred to as "db8151dd" was provided to HIBP after being found left exposed on a publicly facing Elasticsearch server. Later identified as originating from the Covve contacts app, the exposed data included extensive personal information and interactions between Covve users and their contacts. The data was provided to HIBP by dehashed.com.

  5. Ulmon

    ulmon.com
    777.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Bios
    • Email addresses
    • Names
    • Passwords
    • Phone numbers
    • Social media profiles
    In January 2020, the travel app creator Ulmon suffered a data breach. The service had almost 1.3M records with 777k unique email addresses, names, passwords stored as bcrypt hashes and in some cases, social media profile IDs, telephone numbers and bios. The data was subsequently posted to a popular hacking forum.

  6. Elanic

    elanic.in
    2.3Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Geographic locations
    • Usernames
    In January 2020, the Indian fashion marketplace Elanic had 2.8M records with 2.3M unique email addresses posted publicly to a popular hacking forum. Elanic confirmed that they had "verified the data and it was pulled from one of our test servers where this data was exposed publicly" and that the data was "old" (the hacking forum reported it as being from 2016-2018). When asked about disclosure to impacted customers, Elanic advised that they had "decided to not have as such any communication and public disclosure".

  7. TaiLieu

    tailieu.vn
    7.3Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Genders
    • Geographic locations
    • Names
    • Passwords
    • Phone numbers
    • +1 more
    In November 2019, the Vietnamese education website TaiLieu allegedly suffered a data breach exposing 7.3M customer records. Impacted data included names and usernames, email addresses, dates of birth, genders and passwords stored as unsalted MD5 hashes. The data was provided to HIBP by dehashed.com after being shared on a popular hacking forum. TaiLieu did not respond when contacted about the incident.

  8. Tokopedia

    tokopedia.com
    71.4Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Genders
    • Names
    • Passwords
    In April 2020, Indonesia's largest online store Tokopedia suffered a data breach. The incident resulted in 15M rows of data being posted to a popular hacking forum. An additional 76M rows were later provided to HIBP in July 2020. In total, the data included over 71M unique email addresses alongside names, genders, birth dates and passwords stored as SHA2-384 hashes.

  9. Vianet

    vianet.com.np
    94.4Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Phone numbers
    • Physical addresses
    In April 2020, the Nepalese internet service provider Vianet suffered a data breach. The attack on the ISP led to the exposure of 177k customer records including 94k unique email addresses. Also exposed were names, phone numbers and physical addresses.

  10. Aptoide

    aptoide.com
    20Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Browser user agent details
    • Email addresses
    • IP addresses
    • Names
    • Passwords
    In April 2020, the independent Android app store Aptoide suffered a data breach. The incident resulted in the exposure of 20M customer records which were subsequently shared online via a popular hacking forum. Impacted data included email and IP addresses, names, IP addresses and passwords stored as SHA-1 hashes without a salt.

  11. HTC Mania

    htcmania.com
    1.5Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Historical passwords
    • IP addresses
    • Passwords
    • Usernames
    In January 2020, the Spanish mobile phone forum HTC Mania suffered a data breach of the vBulletin based site. The incident exposed 1.5M member email addresses, usernames, IP addresses, dates of birth and salted MD5 password hashes and password histories. Data from the breach was subsequently redistributed on popular hacking websites.

  12. OGUsers (2020 breach)

    ogusers.com
    263.2Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Private messages
    • Usernames
    In April 2020, the account hijacking and SIM swapping forum OGUsers suffered their second data breach in less than a year. As with the previous breach, the exposed data included email and IP addresses, usernames, private messages and passwords stored as salted MD5 hashes. A total of 263k email addresses across user accounts and other tables were posted to a rival hacking forum.

  13. Dueling Network

    duelingnetwork.com
    6.5Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In March 2017, the Flash game based on the Yu-Gi-Oh trading card game Dueling Network suffered a data breach. The site itself was taken offline in 2016 due to a cease-and-desist order but the forum remained online for another year. The data breach exposed usernames, IP and email addresses and passwords stored as MD5 hashes.

  14. Tamodo

    tamodo.com
    494.9Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Genders
    • Geographic locations
    • IP addresses
    • Names
    • Passwords
    In February 2020, the affiliate marketing network Tamodo suffered a data breach which was subsequently shared on a popular hacking forum. The incident exposed almost 500k accounts including names, email addresses, dates of birth and passwords stored as bcrypt hashes. Tamodo failed to respond to multiple attempts to report the breach via published communication channels.

  15. PropTiger

    proptiger.com
    2.2Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Device information
    • Email addresses
    • Genders
    • IP addresses
    • Names
    • Passwords
    In January 2018, the Indian property website PropTiger suffered a data breach which resulted in a 3.46GB database file being exposed and subsequently shared extensively on a popular hacking forum 2 years later. The exposed data contained both user records and login histories with over 2M unique customer email addresses. Exposed data also included additional personal attributes such as names, dates of birth, genders, IP addresses and passwords stored as MD5 hashes. PropTiger advised they believe the usability of the data is "limited" due to how certain data attributes were generated and stored. The data was provided to HIBP by dehashed.com.

  16. The Halloween Spot

    thehalloweenspot.com
    10.7Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Names
    • Phone numbers
    • Physical addresses
    • Purchases
    In September 2019, the Halloween costume store The Halloween Spot suffered a data breach. Originally misattributed to fancy dress store Smiffys, the breach contained 13GB of data with over 10k unique email addresses alongside names, physical and IP addresses, phone numbers and order histories. The Halloween Spot advised customers the breach was traced back to "an old shipping information database".

  17. AnimeGame

    animegame.me
    1.4Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Usernames
    In February 2020, the gaming website AnimeGame suffered a data breach. The incident affected 1.4M subscribers and exposed email addresses, usernames and passwords stored as salted MD5 hashes. The data was subsequently shared on a popular hacking forum and was provided to HIBP by dehashed.com.

  18. Straffic

    straffic.io
    48.6Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Genders
    • Names
    • Phone numbers
    • Physical addresses
    In February 2020, Israeli marketing company Straffic exposed a database with 140GB of personal data. The publicly accessible Elasticsearch database contained over 300M rows with 49M unique email addresses. Exposed data also included names, phone numbers, physical addresses and genders. In their breach disclosure message, Straffic stated that "it is impossible to create a totally immune system, and these things can occur".

  19. Slickwraps

    slickwraps.com
    857.6Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Phone numbers
    • Physical addresses
    • Purchases
    In February 2020, the online store for consumer electronics wraps Slickwraps suffered a data breach. The incident resulted in the exposure of 858k unique email addresses across customer records and newsletter subscribers. Additional impacted data included names, physical addresses, phone numbers and purchase histories.

  20. MGM Resorts

    mgmresorts.com
    3.1Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Names
    • Phone numbers
    • Physical addresses
    In July 2019, MGM Resorts discovered a data breach of one of their cloud services. The breach included 10.6M guest records with 3.1M unique email addresses stemming back to 2017. The exposed data included email and physical addresses, names, phone numbers and dates of birth and was subsequently shared on a popular hacking forum in February 2020 where it was extensively redistributed. The data was provided to HIBP by Under The Breach.

  21. Adult FriendFinder (2016)

    adultfriendfinder.com
    169.7Maccounts
    Breached Disclosed
    Have I Been Pwned Verified Sensitive
    • Email addresses
    • Passwords
    • Spoken languages
    • Usernames
    In October 2016, the adult entertainment company Friend Finder Networks suffered a massive data breach. The incident impacted multiple separate online assets owned by the company, the largest of which was the Adult FriendFinder website alleged to be "the world's largest sex & swinger community". Exposed data included usernames, passwords stored as SHA-1 hashes and 170 million unique email addresses. This incident is separate to the 2015 data breach Adult FriendFinder also suffered. The data was provided to HIBP by dehashed.com.

  22. DailyObjects

    dailyobjects.com
    464.3Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    In approximately January 2018, a collection of more than 464k customer records from the Indian online retailer DailyObjects were leaked online. The data included names, physical and email addresses, phone numbers and "pincodes" stored in plain text. After multiple attempts to contact them, DailyObjects responded and received a copy of the data for verification, however failed to respond to multiple contact attempts following that.

  23. Tout

    tout.com
    652.7Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Bios
    • Email addresses
    • Geographic locations
    • IP addresses
    • Names
    • Passwords
    • Usernames
    In approximately September 2014, the now defunct social networking service Tout suffered a data breach. The breach subsequently appeared years later and included 653k unique email addresses, names, IP addresses, the location of the user, their bio and passwords stored as bcrypt hashes.

  24. europa.jobs

    europa.jobs
    226.1Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Geographic locations
    • Job applications
    • Names
    • Passwords
    • Phone numbers
    • +1 more
    In August 2019, the now defunct European jobs website europa.jobs (Google cache link) suffered a data breach. The incident exposed 226k unique email addresses alongside extensive personal information including names, dates of birth, job applications and passwords. The data was subsequently redistributed on a popular hacking forum.

Breach records: Have I Been Pwned (CC BY 4.0), the HHS OCR breach portal, the Washington State Attorney General and the California Attorney General breach registers (public records). Last synced 59 min ago.