Data Breaches

Check your email or password

Find out whether your email address or a password are leaked somewhere.

Check your email address or password…

  1. Verifications.io

    verifications.io
    763.1Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Employers
    • Genders
    • Geographic locations
    • IP addresses
    • Job titles
    • +3 more
    In February 2019, the email address validation service verifications.io suffered a data breach. Discovered by Bob Diachenko and Vinny Troia, the breach was due to the data being stored in a MongoDB instance left publicly facing without a password and resulted in 763 million unique email addresses being exposed. Many records within the data also included additional personal attributes such as names, phone numbers, IP addresses, dates of birth and genders. No passwords were included in the data. The Verifications.io website went offline during the disclosure process, although an archived copy remains viewable.

  2. ShareThis

    sharethis.com
    41Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Names
    • Passwords
    In July 2018, the social bookmarking and sharing service ShareThis suffered a data breach. The incident exposed 41 million unique email addresses alongside names and in some cases, dates of birth and password hashes. In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly. The data was provided to HIBP by dehashed.com.

  3. Dubsmash

    dubsmash.com
    161.7Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Geographic locations
    • Names
    • Passwords
    • Phone numbers
    • Spoken languages
    • Usernames
    In December 2018, the video messaging service Dubsmash suffered a data breach. The incident exposed 162 million unique email addresses alongside usernames and PBKDF2 password hashes. In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly.

  4. MyFitnessPal

    myfitnesspal.com
    143.6Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In February 2018, the diet and exercise service MyFitnessPal suffered a data breach. The incident exposed 144 million unique email addresses alongside usernames, IP addresses and passwords stored as SHA-1 and bcrypt hashes (the former for earlier accounts, the latter for newer accounts). In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly.

  5. MyHeritage

    myheritage.com
    92Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    In October 2017, the genealogy website MyHeritage suffered a data breach. The incident was reported 7 months later after a security researcher discovered the data and contacted MyHeritage. In total, more than 92M customer records were exposed and included email addresses and salted SHA-1 password hashes. In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly.

  6. EyeEm

    eyeem.com
    19.6Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Bios
    • Email addresses
    • Names
    • Passwords
    • Usernames
    In February 2018, photography website EyeEm suffered a data breach. The breach was identified among a collection of other large incidents and exposed almost 20M unique email addresses, names, usernames, bios and password hashes.

  7. devkitPro

    devkitpro.org
    1.5Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Private messages
    In February 2019, the devkitPro forum suffered a data breach. The phpBB based forum had 1,508 unique email addresses exposed in the breach alongside forum posts, private messages and passwords stored as weak salted hashes. The data breach was self-submitted to HIBP by the forum operator.

  8. Collection #1

    772.9Maccounts
    Breached Disclosed
    Have I Been Pwned Unverified
    • Email addresses
    • Passwords
    In January 2019, a large collection of credential stuffing lists (combinations of email addresses and passwords used to hijack accounts on other services) was discovered being distributed on a popular hacking forum. The data contained almost 2.7 billion records including 773 million unique email addresses alongside passwords those addresses had used on other breached services. Full details on the incident and how to search the breached passwords are provided in the blog post The 773 Million Record "Collection #1" Data Breach.

  9. FaceUP

    faceup.dk
    87.6Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Genders
    • Names
    • Passwords
    • Phone numbers
    • Usernames
    In 2013, the Danish social media site FaceUP suffered a data breach. The incident exposed 87k unique email addresses alongside genders, dates of birth, names, phone numbers and passwords stored as unsalted MD5 hashes. When notified of the incident, FaceUP advised they had identified a SQL injection vulnerability at the time and forced password resets on impacted customers.

  10. Dangdang

    dangdang.com
    4.8Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    In 2011, the Chinese e-commerce site Dangdang suffered a data breach. The incident exposed over 4.8 million unique email addresses which were subsequently traded online over the ensuing years.

  11. BannerBit

    bannerbit.com
    213.4Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    In approximately December 2018, the online ad platform BannerBit suffered a data breach. Containing 213k unique email addresses and plain text passwords, the data was provided to HIBP by a third party. Multiple attempts were made to contact BannerBit, but no response was received.

  12. BlankMediaGames

    blankmediagames.com
    7.6Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Browser user agent details
    • Email addresses
    • IP addresses
    • Passwords
    • Purchases
    • Usernames
    • Website activity
    In December 2018, the Town of Salem website produced by BlankMediaGames suffered a data breach. Reported to HIBP by DeHashed, the data contained 7.6M unique user email addresses alongside usernames, IP addresses, purchase histories and passwords stored as phpass hashes. DeHashed made multiple attempts to contact BlankMediaGames over various channels and many days but had yet to receive a response at the time of publishing.

  13. GoldSilver

    goldsilver.com
    242.7Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Bank account numbers
    • Email addresses
    • IP addresses
    • Names
    • Partial credit card data
    • Passport numbers
    • Phone numbers
    • +4 more
    In October 2018, the bullion education and dealer services site GoldSilver suffered a data breach that exposed 243k unique email addresses spanning customers and mailing list subscribers. An extensive amount of personal information on customers was obtained including names, addresses, phone numbers, purchases and passwords and answers to security questions stored as MD5 hashes. In a small number of cases, passport, social security numbers and partial credit card data was also exposed. The data breach and source code belonging to GoldSilver was publicly posted on a dark web service where it remained months later. When notified about the incident, GoldSilver advised that "all affected customers have been directly notified".

  14. Mappery

    mappery.com
    205.2Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Geographic locations
    • Passwords
    • Usernames
    In December 2018, the mapping website Mappery suffered a data breach that exposed over 205k unique email addresses. The incident also exposed usernames, the geographic location of the user and passwords stored as unsalted SHA-1 hashes. No response was received from Mappery when contacted about the incident.

  15. Bombuj.eu

    bombuj.eu
    575.4Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    In December 2018, the Slovak website for watching movies online for free Bombuj.eu suffered a data breach. The incident exposed over 575k unique email addresses and passwords stored as unsalted MD5 hashes. No response was received from Bombuj.eu when contacted about the incident.

  16. Hub4Tech

    hub4tech.com
    36.9Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    On an unknown date in approximately 2017, the Indian training and assessment service known as Hub4Tech suffered a data breach via a SQL injection attack. The incident exposed almost 37k unique email addresses and passwords stored as unsalted MD5 hashes. No response was received from Hub4Tech when contacted about the incident.

  17. You've Been Scraped

    66.1Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Employers
    • Geographic locations
    • Job titles
    • Names
    • Social media profiles
    In October and November 2018, security researcher Bob Diachenko identified several unprotected MongoDB instances believed to be hosted by a data aggregator. Containing a total of over 66M records, the owner of the data couldn't be identified but it is believed to have been scraped from LinkedIn hence the title "You've Been Scraped". The exposed records included names, both work and personal email addresses, job titles and links to the individuals' LinkedIn profiles.

  18. AerServ

    aerserv.com
    66.3Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Employers
    • Job titles
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    In April 2018, the ad management platform known as AerServ suffered a data breach. Acquired by InMobi earlier in the year, the AerServ breach impacted over 66k unique email addresses and also included contact information and passwords stored as salted SHA-512 hashes. The data was publicly posted to Twitter later in 2018 after which InMobi was notified and advised they were aware of the incident.

  19. ForumCommunity

    forumcommunity.net
    776.6Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Usernames
    In approximately mid-2016, the Italian-based service for creating forums known as ForumCommunity suffered a data breach. The incident impacted over 776k unique email addresses along with usernames and unsalted MD5 password hashes. No response was received from ForumCommunity when contacted.

  20. Technic

    technicpack.net
    265.4Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Chat logs
    • Email addresses
    • IP addresses
    • Passwords
    • Private messages
    • Time zones
    In November 2018, the Minecraft modpack platform known as Technic suffered a data breach. Technic promptly disclosed the breach and advised that the impacted data included over 265k unique users' email and IP addresses, chat logs, private messages and passwords stored as bcrypt hashes with a work factor of 13. Technic self-submitted the breach to HIBP.

  21. Data & Leads

    datanleads.com
    44.3Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Employers
    • IP addresses
    • Job titles
    • Names
    • Phone numbers
    • Physical addresses
    In November 2018, security researcher Bob Diachenko identified an unprotected database believed to be hosted by a data aggregator. Upon further investigation, the data was linked to marketing company Data & Leads. The exposed Elasticsearch instance contained over 44M unique email addresses along with names, IP and physical addresses, phone numbers and employment information. No response was received from Data & Leads when contacted by Bob and their site subsequently went offline.

  22. Adapt

    adapt.io
    9.4Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Employers
    • Job titles
    • Names
    • Phone numbers
    • Physical addresses
    • Social media profiles
    In November 2018, security researcher Bob Diachenko identified an unprotected database hosted by data aggregator "Adapt". A provider of "Fresh Quality Contacts", the service exposed over 9.3M unique records of individuals and employer information including their names, employers, job titles, contact information and data relating to the employer including organisation description, size and revenue. No response was received from Adapt when contacted.

  23. HTH Studios

    hthstudios.com
    411.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified Sensitive
    • Browser user agent details
    • Dates of birth
    • Email addresses
    • IP addresses
    • Names
    • Phone numbers
    • Physical addresses
    • +2 more
    In August 2018, the adult furry interactive game creator HTH Studios suffered a data breach impacting multiple repositories of customer data. Several months later, the data surfaced on a popular hacking forum and included 411k unique email addresses along with physical and IP addresses, names, orders, salted SHA-1 and salted MD5 hashes. HTH Studios is aware of the incident.

  24. Elasticsearch Instance of Sales Leads on AWS

    5.8Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Employers
    • Names
    • Physical addresses
    In October 2018, security researcher Bob Diachenko identified multiple exposed databases with hundreds of millions of records. One of those datasets was an Elasticsearch instance on AWS containing sales lead data and 5.8M unique email addresses. The data contained information relating to individuals and the companies they worked for including their names, email addresses and company name and contact information. Despite best efforts, it was not possible to identify the owner of the data hence this breach as been titled "Elasticsearch Sales Leads".

Breach records: Have I Been Pwned (CC BY 4.0), the HHS OCR breach portal, the Washington State Attorney General and the California Attorney General breach registers (public records). Last synced 22 hours ago.