Data Breaches

1. January 2020
2. U

   Universarium

   universarium.org

   565Kaccounts

   Breached 1 Nov 2019 Disclosed 3 Jan 2020

   Have I Been Pwned Verified

   • Email addresses
   • Passwords

   In approximately November 2019, the Russian "Remote preparatory faculty for IT specialties" Universarium suffered a data breach. The incident exposed 565k email addresses and passwords in plain text. Universarium did not respond to multiple attempts to make contact over a period of many weeks. The data was provided to HIBP by dehashed.com.
3. December 2019
4. F

   Factual

   factual.com

   2.5Maccounts

   Breached 22 Mar 2017 Disclosed 24 Dec 2019

   Have I Been Pwned Verified

   • Email addresses
   • Employers
   • Phone numbers
   • Physical addresses

   In March 2017, a file containing 8M rows of data allegedly sourced from data aggregator Factual was compiled and later exchanged on the premise it was a "breach". The data contained 2.5M unique email addresses alongside business names, addresses and phone numbers. After consultation with Factual, they advised the data was "publicly available information about businesses and other points of interest that Factual makes available on its website and to customers".
5. Z

   Zynga

   zynga.com

   172.9Maccounts

   Breached 1 Sep 2019 Disclosed 19 Dec 2019

   Have I Been Pwned Verified

   • Email addresses
   • Passwords
   • Phone numbers
   • Usernames

   In September 2019, game developer Zynga (the creator of Words with Friends) suffered a data breach. The incident exposed 173M unique email addresses alongside usernames and passwords stored as salted SHA-1 hashes. The data was provided to HIBP by dehashed.com.
6. A

   AgusiQ-Torrents.pl

   agusiq-torrents.pl

   90.5Kaccounts

   Breached 24 Sep 2019 Disclosed 4 Dec 2019

   Have I Been Pwned Verified

   • Email addresses
   • IP addresses
   • Passwords
   • Usernames

   In September 2019, Polish torrent site AgusiQ-Torrents.pl suffered a data breach. The incident exposed 90k member records including email and IP addresses, usernames and passwords stored as MD5 hashes.
7. November 2019
8. D

   Data Enrichment Exposure From PDL Customer

   622.2Maccounts

   Breached 16 Oct 2019 Disclosed 22 Nov 2019

   Have I Been Pwned Verified

   • Email addresses
   • Employers
   • Geographic locations
   • Job titles
   • Names
   • Phone numbers
   • Social media profiles

   In October 2019, security researchers Vinny Troia and Bob Diachenko identified an unprotected Elasticsearch server holding 1.2 billion records of personal data. The exposed data included an index indicating it was sourced from data enrichment company People Data Labs (PDL) and contained 622 million unique email addresses. The server was not owned by PDL and it's believed a customer failed to properly secure the database. Exposed information included email addresses, phone numbers, social media profiles and job history data.
9. G

   GateHub

   gatehub.net

   1.4Maccounts

   Breached 4 Jun 2019 Disclosed 20 Nov 2019

   Have I Been Pwned Verified

   • Email addresses
   • Encrypted keys
   • Mnemonic phrases
   • Passwords

   In October 2019, 1.4M accounts from the cryptocurrency wallet service GateHub were posted to a popular hacking forum. GateHub had previously acknowledged a data breach in June, albeit with a smaller number of impacted accounts. Data from the breach included email addresses, mnemonic phrases, encrypted master keys, encrypted recovery keys and passwords stored as bcrypt hashes.
10. E

    EpicBot

    epicbot.com

    816.7Kaccounts

    Breached 1 Sep 2019 Disclosed 20 Nov 2019

    Have I Been Pwned Verified

    • Email addresses
    • IP addresses
    • Passwords
    • Usernames

    In September 2019, the RuneScape bot provider EpicBot suffered a data breach that impacted 817k subscribers. Data from the breach was subsequently shared on a popular hacking forum and included usernames, email and IP addresses and passwords stored as either salted MD5 or bcrypt hashes. EpicBot did not respond when contacted about the incident.
11. G

    GPS Underground

    gpsunderground.com

    669.6Kaccounts

    Breached 1 Jul 2016 Disclosed 19 Nov 2019

    Have I Been Pwned Verified

    • Dates of birth
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames

    In early 2017, GPS Underground was amongst a collection of compromised vBulletin websites that were found being sold online. The breach dated back to mid-2016 and included 670k records with usernames, email and IP addresses, dates of birth and salted MD5 password hashes.
12. T

    ToonDoo

    toondoo.com

    6Maccounts

    Breached 21 Aug 2019 Disclosed 11 Nov 2019

    Have I Been Pwned Verified

    • Email addresses
    • Genders
    • Geographic locations
    • IP addresses
    • Passwords
    • Usernames

    In August 2019, the comic strip creation website ToonDoo suffered a data breach. The data was subsequently redistributed on a popular hacking forum in November where the personal information of over 6M subscribers was shared. Impacted data included email and IP addresses, usernames, genders, the location of the individual and salted password hashes.
13. V

    Vedantu

    vedantu.com

    686.9Kaccounts

    Breached 8 Jul 2019 Disclosed 1 Nov 2019

    Have I Been Pwned Verified

    • Browser user agent details
    • Email addresses
    • Genders
    • IP addresses
    • Names
    • Passwords
    • Phone numbers
    • +3 more

    In mid-2019, the Indian interactive online tutoring platform Vedantu suffered a data breach which exposed the personal data of 687k users. The JSON formatted database dump exposed extensive personal information including email and IP address, names, phone numbers, genders and passwords stored as bcrypt hashes. When contacted about the incident, Vedantu advised that they were aware of the breach and were in the process of informing their customers.
14. October 2019
15. H

    Hookers.nl

    hookers.nl

    291Kaccounts

    Breached 10 Oct 2019 Disclosed 23 Oct 2019

    Have I Been Pwned Verified Sensitive

    • Email addresses
    • IP addresses
    • Passwords
    • Usernames

    In October 2019, the Dutch prostitution forum Hookers.nl suffered a data breach which exposed the personal information of sex workers and their customers. The IP and email addresses, usernames and either bcrypt or salted MD5 password hashes of 291k members were accessed via an unpatched vulnerability in the vBulletin forum software.
16. Z

    Zooville

    zooville.org

    71.4Kaccounts

    Breached 27 Sep 2019 Disclosed 19 Oct 2019

    Have I Been Pwned Verified Sensitive

    • Dates of birth
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames

    In September 2019, the zoophilia and bestiality forum Zooville suffered a data breach. The usernames and email addresses of 71k members were accessed via an unpatched vulnerability in the vBulletin forum software then subsequently distributed online. A second data set was later provided to HIBP which contained a complete vBulletin database dump including IP addresses, dates of birth and passwords stored as bcrypt hashes. The site administrator advised that following the breach, all data had been deleted from the forum and a new one had been stood up on the XenForo platform.
17. S

    StreetEasy

    streeteasy.com

    988.2Kaccounts

    Breached 28 Jun 2016 Disclosed 6 Oct 2019

    Have I Been Pwned Verified

    • Email addresses
    • Names
    • Passwords
    • Usernames

    In approximately June 2016, the real estate website StreetEasy suffered a data breach. In total, 988k unique email addresses were included in the breach alongside names, usernames and SHA-1 hashes of passwords, all of which appeared for sale on a dark web marketplace in February 2019.
18. S

    Sephora

    sephora.com.au

    780.1Kaccounts

    Breached 9 Jan 2017 Disclosed 6 Oct 2019

    Have I Been Pwned Verified

    • Dates of birth
    • Email addresses
    • Ethnicities
    • Genders
    • Names
    • Physical attributes

    In approximately January 2017, the beauty store Sephora suffered a data breach. Impacting customers in South East Asia, Australia and New Zealand, 780k unique email addresses were included in the breach alongside names, genders, dates of birth, ethnicities and other personal information.
19. September 2019
20. W

    Wanelo

    wanelo.com

    23.2Maccounts

    Breached 13 Dec 2018 Disclosed 30 Sep 2019

    Have I Been Pwned Verified

    • Email addresses
    • IP addresses
    • Names
    • Passwords
    • Physical addresses

    In approximately December 2018, the digital mall Wanelo suffered a data breach. The data was later placed up for sale on a dark web marketplace along with a collection of other data breaches in April 2019. A total of 23 million unique email addresses were included in the breach alongside passwords stored as either MD5 or bcrypt hashes. After the initial HIBP load, further data containing names, shipping addresses and IP addresses were also provided to HIBP, albeit without direct association to the email addresses and passwords.
21. L

    Lumin PDF

    luminpdf.com

    15.5Maccounts

    Breached 1 Apr 2019 Disclosed 18 Sep 2019

    Have I Been Pwned Verified

    • Auth tokens
    • Email addresses
    • Genders
    • Names
    • Passwords
    • Spoken languages
    • Usernames

    In April 2019, the PDF management service Lumin PDF suffered a data breach. The breach wasn't publicly disclosed until September when 15.5M records of user data appeared for download on a popular hacking forum. The data had been left publicly exposed in a MongoDB instance after which Lumin PDF was allegedly been "contacted multiple times, but ignored all the queries". The exposed data included names, email addresses, genders, spoken language and either a bcrypt password hash or Google auth token.
22. K

    KiwiFarms

    kiwifarms.net

    4.6Kaccounts

    Breached 10 Sep 2019 Disclosed 17 Sep 2019

    Have I Been Pwned Verified

    • Avatars
    • Dates of birth
    • Email addresses
    • IP addresses
    • Website activity

    In September 2019, the forum for discussing "lolcows" (people who can be milked for laughs) Kiwi Farms suffered a data breach. The disclosure notice advised that email and IP addresses, dates of birth and content created by members were all exposed in the incident.
23. M

    Minehut

    minehut.com

    396.5Kaccounts

    Breached 17 May 2019 Disclosed 17 Sep 2019

    Have I Been Pwned Verified

    • Email addresses
    • Passwords

    In May 2019, the Minecraft server website Minehut suffered a data breach. The company advised a database backup had been obtained after which they subsequently notified all impacted users. 397k email addresses from the incident were provided to HIBP. A data set with both email addresses and bcrypt password hashes was also later provided to HIBP.
24. V

    Void.to

    void.to

    95.4Kaccounts

    Breached 13 Jun 2019 Disclosed 11 Sep 2019

    Have I Been Pwned Verified

    • Email addresses
    • IP addresses
    • Passwords
    • Private messages
    • Usernames

    In June 2019, the hacking website Void.to suffered a data breach. There were 95k unique email addresses spread across 86k forum users and other tables in the database. A rival hacking website claimed responsibility for breaching the MyBB based forum which disclosed email and IP addresses, usernames, private messages and passwords stored as either salted MD5 or bcrypt hashes.
25. P

    Poshmark

    poshmark.com

    36.4Maccounts

    Breached 16 May 2018 Disclosed 2 Sep 2019

    Have I Been Pwned Verified

    • Email addresses
    • Genders
    • Geographic locations
    • Names
    • Passwords
    • Usernames

    In mid-2018, social commerce marketplace Poshmark suffered a data breach that exposed 36M user accounts. The compromised data included email addresses, names, usernames, genders, locations and passwords stored as bcrypt hashes.
26. M

    Mastercard Priceless Specials

    specials.mastercard.de

    89.4Kaccounts

    Breached 20 Aug 2019 Disclosed 1 Sep 2019

    Have I Been Pwned Verified

    • Email addresses
    • IP addresses
    • Names
    • Partial credit card data
    • Phone numbers
    • Salutations

    In August 2019, the German Mastercard bonus program "Priceless Specials" suffered a data breach. Personal data on almost 90k program members was subsequently extensively circulated online and included names, email and IP addresses, phone numbers and partial credit card data. Following the incident, the program was subsequently suspended.
27. X

    XKCD

    xkcd.com

    562Kaccounts

    Breached 1 Jul 2019 Disclosed 1 Sep 2019

    Have I Been Pwned Verified

    • Email addresses
    • IP addresses
    • Passwords
    • Usernames

    In July 2019, the forum for webcomic XKCD suffered a data breach that impacted 562k subscribers. The breached phpBB forum leaked usernames, email and IP addresses and passwords stored in MD5 phpBB3 format. The data was provided to HIBP by white hat security researcher and data analyst Adam Davies.
28. August 2019
29. C

    Coinmama

    coinmama.com

    478.8Kaccounts

    Breached 3 Aug 2017 Disclosed 30 Aug 2019

    Have I Been Pwned Verified

    • Email addresses
    • Passwords
    • Usernames

    In August 2017, the crypto coin brokerage service Coinmama suffered a data breach that impacted 479k subscribers. The breach was discovered in February 2019 with exposed data including email addresses, usernames and passwords stored as MD5 WordPress hashes. The data was provided to HIBP by white hat security researcher and data analyst Adam Davies.
30. C

    Chegg

    chegg.com

    39.7Maccounts

    Breached 28 Apr 2018 Disclosed 16 Aug 2019

    Have I Been Pwned Verified

    • Email addresses
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    • Usernames

    In April 2018, the textbook rental service Chegg suffered a data breach that impacted 40 million subscribers. The exposed data included email addresses, usernames, names and passwords stored as unsalted MD5 hashes. A small number of records also contained physical address or phone number.

Breach records: Have I Been Pwned (CC BY 4.0), the HHS OCR breach portal, the Washington State Attorney General and the California Attorney General breach registers (public records). Last synced 23 hours ago.