Data Breaches

Check your email or password

Find out whether your email address or a password are leaked somewhere.

Check your email address or password…

  1. KnownCircle

    knowncircle.com
    2Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Email messages
    • Genders
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    In approximately April 2016, the "marketing automation for agents and professional service providers" company KnownCircle had a large volume of data obtained by an external party. The data belonging to the now defunct service appeared in JSON format and contained gigabytes of data related to the real estate and insurance sectors. The personal data in the breach appears to have primarily been used for marketing purposes, including logs of emails sent and tracking of gift cards. A small number of passwords for KnownCircle staff were also present and were stored as bcrypt hashes.

  2. Rbx.Rocks

    rbx.rocks
    150Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    In August 2018, the Roblox trading site Rbx.Rocks suffered a data breach. Almost 25k records were sent to HIBP in November and included names, email addresses and passwords stored as bcrypt hashes. In July 2019, a further 125k records emerged bringing the total size of the incident to 150k. The website has since gone offline with a message stating that "Rbx.Rocks v2.0 is currently under construction".

  4. WPSandbox

    wpsandbox.io
    858accounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    In November 2018, the WordPress sandboxing service that allows people to create temporary websites WP Sandbox discovered their service was being used to host a phishing site attempting to collect Microsoft OneDrive accounts. After identifying the malicious site, WP Sandbox took it offline, contacted the 858 people who provided information to it then self-submitted their addresses to HIBP. The phishing page requested both email addresses and passwords.

  5. JoomlArt

    joomlart.com
    22.5Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    • Payment histories
    • Usernames
    In January 2018, the Joomla template website JoomlArt inadvertently exposed more than 22k unique customer records in a Jira ticket. The exposed data was from iJoomla and JomSocial, both services that JoomlArt acquired the previous year. The data included usernames, email addresses, purchases and passwords stored as MD5 hashes. When contacted, JoomlArt advised they were aware of the incident and had previously notified impacted parties.

  6. Mac Forums

    mac-forums.com
    326.7Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In July 2016, the self-proclaimed "Ultimate Source For Your Mac" website Mac Forums suffered a data breach. The vBulletin-based system exposed over 326k usernames, email and IP addresses, dates of birth and passwords stored as salted MD5 hashes. The data was later discovered being traded on a popular hacking forum. Mac Forums did not respond when contacted about the incident via their contact us form.

  7. Baby Names

    babynames.com
    846.7Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    In approximately 2008, the site to help parents name their children known as Baby Names suffered a data breach. The incident exposed 846k email addresses and passwords stored as salted MD5 hashes. When contacted in October 2018, Baby Names advised that "the breach happened at least ten years ago" and that members were notified at the time.

  8. Wife Lovers

    wifelovers.com
    1.3Maccounts
    Breached Disclosed
    Have I Been Pwned Verified Sensitive
    • Email addresses
    • IP addresses
    • Names
    • Passwords
    • Usernames
    In October 2018, the site dedicated to posting naked photos and other erotica of wives Wife Lovers suffered a data breach. The underlying database supported a total of 8 different adult websites and contained over 1.2M unique email addresses. Wife Lovers acknowledged the breach which impacted names, usernames, email and IP addresses and passwords hashed using the weak DEScrypt algorithm. The breach has been marked as "sensitive" due to the nature of the site.

  9. Facepunch

    facepunch.com
    342.9Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In June 2016, the game development studio Facepunch suffered a data breach that exposed 343k users. The breached data included usernames, email and IP addresses, dates of birth and salted MD5 password hashes. Facepunch advised they were aware of the incident and had notified people at the time. The data was provided to HIBP by whitehat security researcher and data analyst Adam Davies.

  10. Apollo

    apollo.io
    125.9Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Employers
    • Geographic locations
    • Job titles
    • Names
    • Phone numbers
    • Salutations
    • +1 more
    In July 2018, the sales engagement startup Apollo left a database containing billions of data points publicly exposed without a password. The data was discovered by security researcher Vinny Troia who subsequently sent a subset of the data containing 126 million unique email addresses to Have I Been Pwned. The data left exposed by Apollo was used in their "revenue acceleration platform" and included personal information such as names and email addresses as well as professional information including places of employment, the roles people hold and where they're located. Apollo stressed that the exposed data did not include sensitive information such as passwords, social security numbers or financial data. The Apollo website has a contact form for those looking to get in touch with the organisation.

  11. Real Estate Mogul

    realestatemogul.com
    307.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Phone numbers
    • Physical addresses
    In September 2016, the real estate investment site Real Estate Mogul had a Mongo DB instance compromised and 5GB of data downloaded by an unauthorised party. The data contained real estate listings including addresses and the names, phone numbers and 308k unique email addresses of the sellers. Real Estate Mogul was advised of the incident in September 2018 and stated that they "found no instance of user account credentials like usernames and passwords nor billing information within this file".

  12. Kayo.moe Credential Stuffing List

    41.8Maccounts
    Breached Disclosed
    Have I Been Pwned Unverified
    • Email addresses
    • Passwords
    In September 2018, a collection of almost 42 million email address and plain text password pairs was uploaded to the anonymous file sharing service kayo.moe. The operator of the service contacted HIBP to report the data which, upon further investigation, turned out to be a large credential stuffing list. For more information, read about The 42M Record kayo.moe Credential Stuffing Data.

  13. Russian America

    russianamerica.com
    182.7Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    • Phone numbers
    In approximately 2017, the website for Russian speakers in America known as Russian America suffered a data breach. The incident exposed 183k unique records including names, email addresses, phone numbers and passwords stored in both plain text and as MD5 hashes. Russian America was contacted about the breach but did not respond.

  14. FreshMenu

    freshmenu.com
    110.4Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Device information
    • Email addresses
    • Names
    • Phone numbers
    • Physical addresses
    • Purchases
    In July 2016, the India-based food delivery service FreshMenu suffered a data breach. The incident exposed the personal data of over 110k customers and included their names, email addresses, phone numbers, home addresses and order histories. When advised of the incident, FreshMenu acknowledged being already aware of the breach but stated they had decided not to notify impacted customers.

  15. NapsGear

    napsgear.org
    287.1Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified Sensitive
    • Dates of birth
    • Email addresses
    • Genders
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    • +1 more
    In October 2015, the anabolic steroids retailer NapsGear suffered a data breach. An extensive amount of personal information on 287k customers was exposed including email addresses, names, addresses, phone numbers, purchase histories and salted MD5 password hashes.

  16. Warmane

    warmane.com
    1.1Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Passwords
    • Usernames
    In approximately December 2016, the online service for World of Warcraft private servers Warmane suffered a data breach. The incident exposed over 1.1M accounts including usernames, email addresses, dates of birth and salted MD5 password hashes. The data was subsequently extensively circulated online and was later provided to HIBP by whitehat security researcher and data analyst Adam Davies.

  17. Mortal Online

    mortalonline.com
    606.6Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    • Physical addresses
    • Usernames
    In June 2018, the massively multiplayer online role-playing game (MMORPG) Mortal Online suffered a data breach. A file containing 570k email addresses and cracked passwords was subsequently distributed online. A larger more complete file containing 607k email addresses with original unsalted MD5 password hashes along with names, usernames and physical addresses was later provided and the original breach in HIBP was updated accordingly. The data was provided to HIBP by whitehat security researcher and data analyst Adam Davies.

  18. SvenskaMagic

    svenskamagic.com
    30.3Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Usernames
    Sometime in 2015, the Swedish magic website SvenskaMagic suffered a data breach that exposed over 30k records. The compromised data included usernames, email addresses and MD5 password hashes. The data was self-submitted to HIBP by SvenskaMagic.

  19. Atlas Quantum

    atlasquantum.com
    261.5Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Account balances
    • Email addresses
    • Names
    • Phone numbers
    In August 2018, the cryptocurrency investment platform Atlas Quantum suffered a data breach. The breach leaked the personal data of 261k investors on the platform including their names, phone numbers, email addresses and account balances.

  20. SpyFone

    spyfone.com
    44.1Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified Sensitive
    • Audio recordings
    • Browsing histories
    • Device information
    • Email addresses
    • Geographic locations
    • IMEI numbers
    • IP addresses
    • +4 more
    In August 2018, the spyware company SpyFone left terabytes of data publicly exposed. Collected surreptitiously whilst the targets were using their devices, the data included photos, audio recordings, text messages and browsing history which were then exposed via a number of misconfigurations within SpyFone's systems. The data belonged the thousands of SpyFone customers and included 44k unique email addresses, many likely belonging to people the targeted phones had contact with.

  21. MyFHA

    myfha.net
    972.6Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Credit status information
    • Email addresses
    • Income levels
    • IP addresses
    • Loan information
    • Names
    • Passwords
    • +2 more
    In approximately February 2015, the home financing website MyFHA suffered a data breach which disclosed the personal information of nearly 1 million people. The data included extensive personal information relating to home financing including personal contact info, credit statuses, household incomes, loan amounts and notes on personal circumstances, often referring to legal issues, divorces and health conditions. Multiple parties contacted HIBP with the data after which MyFHA was alerted in mid-July and acknowledged the legitimacy of the breach then took the site offline.

  22. Lanwar

    lanwar.com
    45.1Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    • Physical addresses
    • Usernames
    In July 2018, staff of the Lanwar gaming site discovered a data breach they believe dates back to sometime over the previous several months. The data contained 45k names, email addresses, usernames and plain text passwords. A Lanwar staff member self-submitted the breach to HIBP and has also contacted the relevant authorities about the incident after identifying a phishing attempt to extort Bitcoin from a user.

  23. Adult-FanFiction.Org

    adult-fanfiction.org
    186.1Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified Sensitive
    • Dates of birth
    • Email addresses
    • Names
    • Passwords
    In May 2018, the website for sharing adult-orientated works of fiction known as Adult-FanFiction.Org had 186k records exposed in a data breach. The data contained names, email addresses, dates of birth and passwords stored as both MD5 hashes and plain text. AFF did not respond when contacted about the breach and the site was previously reported as compromised on the Vigilante.pw breached database directory.

  24. Fashion Nexus

    fashionnexus.co.uk
    1.3Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Browser user agent details
    • Dates of birth
    • Email addresses
    • Genders
    • IP addresses
    • Names
    • Passwords
    • +3 more
    In July 2018, UK-based ecommerce company Fashion Nexus suffered a data breach which exposed 1.4 million records. Multiple websites developed by sister company White Room Solutions were impacted in the breach amongst which were sites including Jaded London and AX Paris. The various sites exposed in the incident included a range of different data types including names, phone numbers, addresses and passwords stored as a mix of salted MD5 and SHA-1 as well as unsalted MD5 passwords. When asked by reporter Graham Cluley if a public statement on the incident was available, a one-word response of "No" was received.

Breach records: Have I Been Pwned (CC BY 4.0), the HHS OCR breach portal, the Washington State Attorney General and the California Attorney General breach registers (public records). Last synced 21 hours ago.