Data Breaches

1. July 2018
2. L

   League of Legends

   leagueoflegends.com

   339.5Kaccounts

   Breached 11 Jun 2012 Disclosed 28 Jul 2018

   Have I Been Pwned Verified

   • Email addresses
   • Passwords
   • Usernames

   In June 2012, the multiplayer online game League of Legends suffered a data breach. At the time, the service had more than 32 million registered accounts and the breach affected various personal data attributes including "encrypted" passwords. In 2018, a 339k record subset of the data emerged with email addresses, usernames and plain text passwords, likely cracked from the original cryptographically protected ones.
3. E

   Exactis

   exactis.com

   131.6Maccounts

   Breached 1 Jun 2018 Disclosed 25 Jul 2018

   Have I Been Pwned Verified

   • Credit status information
   • Dates of birth
   • Education levels
   • Email addresses
   • Ethnicities
   • Family structure
   • Financial investments
   • +13 more

   In June 2018, the marketing firm Exactis inadvertently publicly leaked 340 million records of personal data. Security researcher Vinny Troia of Night Lion Security discovered the leak contained multiple terabytes of personal information spread across hundreds of separate fields including addresses, phone numbers, family structures and extensive profiling data. The data was collected as part of Exactis' service as a "compiler and aggregator of premium business & consumer data" which they then sell for profiling and marketing purposes. A small subset of the exposed fields were provided to Have I Been Pwned and contained 132 million unique email addresses.
4. F

   Funny Games

   funny-games.biz

   764.4Kaccounts

   Breached 28 Apr 2018 Disclosed 24 Jul 2018

   Have I Been Pwned Verified

   • Email addresses
   • IP addresses
   • Passwords
   • Usernames

   In April 2018, the online entertainment site Funny Games suffered a data breach that disclosed 764k records including usernames, email and IP addresses and salted MD5 password hashes. The incident was disclosed to Funny Games in July who acknowledged the breach and identified it had been caused by legacy code no longer in use. The record count in the breach constitute approximately half of the user base.
5. P

   Pemiblanc

   pemiblanc.com

   111Maccounts

   Breached 2 Apr 2018 Disclosed 10 Jul 2018

   Have I Been Pwned Unverified

   • Email addresses
   • Passwords

   In April 2018, a credential stuffing list containing 111 million email addresses and passwords known as Pemiblanc was discovered on a French server. The list contained email addresses and passwords collated from different data breaches and used to mount account takeover attacks against other services. Read more about the incident.
6. Y

   Yatra

   yatra.com

   5Maccounts

   Breached 1 Sep 2013 Disclosed 5 Jul 2018

   Have I Been Pwned Verified

   • Dates of birth
   • Email addresses
   • Names
   • Passwords
   • Phone numbers
   • Physical addresses
   • PINs

   In September 2013, the Indian bookings website known as Yatra had 5 million records exposed in a data breach. The data contained email and physical addresses, dates of birth and phone numbers along with both PINs and passwords stored in plain text. The site was previously reported as compromised on the Vigilante.pw breached database directory.
7. L

   Light's Hope

   lightshope.org

   30.5Kaccounts

   Breached 25 Jun 2018 Disclosed 4 Jul 2018

   Have I Been Pwned Verified

   • Dates of birth
   • Email addresses
   • Geographic locations
   • IP addresses
   • Passwords
   • Private messages
   • Usernames

   In June 2018, the World of Warcraft service Light's Hope suffered a data breach which they subsequently self-submitted to HIBP. Over 30K unique users were impacted and their exposed data included email addresses, dates of birth, private messages and passwords stored as bcrypt hashes.
8. G

   Gaadi

   gaadi.com

   4.3Maccounts

   Breached 14 May 2015 Disclosed 1 Jul 2018

   Have I Been Pwned Verified

   • Email addresses
   • Genders
   • Geographic locations
   • IP addresses
   • Names
   • Passwords
   • Phone numbers
   • +1 more

   In May 2015, the Indian motoring website known as Gaadi had 4.3 million records exposed in a data breach. The data contained usernames, email and IP addresses, genders, the city of users as well as passwords stored in both plain text and as MD5 hashes. The site was previously reported as compromised on the Vigilante.pw breached database directory.
9. June 2018
10. E

    Estonian Citizens (via Estonian Cybercrime Bureau)

    655.2Kaccounts

    Breached 7 Jun 2018 Disclosed 11 Jun 2018

    Have I Been Pwned Verified

    • Email addresses
    • Passwords

    In June 2018, the Cybercrime Bureau of the Estonian Central Criminal Police contacted HIBP and asked for assistance in making a data set of 655k email addresses searchable. The Estonian police suspected the email addresses and passwords they obtained were being used to access mailboxes, cryptocurrency exchanges, cloud service accounts and other similar online assets. They've requested that individuals who find themselves in the data set and also identify that cryptocurrency has been stolen contact them at [email protected].
11. C

    Creative

    creative.com

    483Kaccounts

    Breached 1 May 2018 Disclosed 7 Jun 2018

    Have I Been Pwned Verified

    • Email addresses
    • IP addresses
    • Passwords
    • Usernames

    In May 2018, the forum for Singaporean hardware company Creative Technology suffered a data breach which resulted in the disclosure of 483k unique email addresses. Running on an old version of vBulletin, the breach also disclosed usernames, IP addresses and salted MD5 password hashes. After being notified of the incident, Creative permanently shut down the forum.
12. L

    Linux Forums

    linuxforums.org

    275.8Kaccounts

    Breached 1 May 2018 Disclosed 7 Jun 2018

    Have I Been Pwned Verified

    • Email addresses
    • IP addresses
    • Passwords
    • Usernames

    In May 2018, the Linux Forums website suffered a data breach which resulted in the disclosure of 276k unique email addresses. Running on an old version of vBulletin, the breach also disclosed usernames, IP addresses and salted MD5 password hashes. Linux Forums did not respond to multiple attempts to contact them about the breach.
13. T

    Ticketfly

    ticketfly.com

    26.2Maccounts

    Breached 31 May 2018 Disclosed 3 Jun 2018

    Have I Been Pwned Verified

    • Email addresses
    • Names
    • Phone numbers
    • Physical addresses

    In May 2018, the website for the ticket distribution service Ticketfly was defaced by an attacker and was subsequently taken offline. The attacker allegedly requested a ransom to share details of the vulnerability with Ticketfly but did not receive a reply and subsequently posted the breached data online to a publicly accessible location. The data included over 26 million unique email addresses along with names, physical addresses and phone numbers. Whilst there were no passwords in the publicly leaked data, Ticketfly later issued an incident update and stated that "It is possible, however, that hashed values of password credentials could have been accessed".
14. May 2018
15. V

    ViewFines

    viewfines.co.za

    777.6Kaccounts

    Breached 7 May 2018 Disclosed 24 May 2018

    Have I Been Pwned Verified

    • Email addresses
    • Government issued IDs
    • Names
    • Passwords
    • Phone numbers

    In May 2018, the South African website for viewing traffic fines online known as ViewFines suffered a data breach. Over 934k records containing 778k unique email addresses were exposed and included names, phone numbers, government issued IDs and passwords stored in plain text.
16. April 2018
17. V

    VNG

    zing.vn

    24.9Maccounts

    Breached 19 May 2015 Disclosed 28 Apr 2018

    Have I Been Pwned Verified

    • Dates of birth
    • Email addresses
    • Genders
    • IP addresses
    • Marital statuses
    • Names
    • Occupations
    • +4 more

    In April 2018, news broke of a massive data breach impacting the Vietnamese company known as VNG after data was discovered being traded on a popular hacking forum where it was extensively redistributed. The breach dated back to an incident in May of 2015 and included of over 163 million customers. The data in the breach contained a wide range of personal attributes including usernames, birth dates, genders and home addresses along with unsalted MD5 hashes and 25 million unique email addresses. The data was provided to HIBP by dehashed.com.
18. 1

    17173

    17173.com

    7.5Maccounts

    Breached 28 Dec 2011 Disclosed 28 Apr 2018

    Have I Been Pwned Unverified

    • Email addresses
    • Passwords
    • Usernames

    In late 2011, a series of data breaches in China affected up to 100 million users, including 7.5 million from the gaming site known as 17173. Whilst there is evidence that the data is legitimate, due to the difficulty of emphatically verifying the Chinese breach it has been flagged as "unverified". The data in the breach contains usernames, email addresses and salted MD5 password hashes and was provided with support from dehashed.com. Read more about Chinese data breaches in Have I Been Pwned.
19. T

    TGBUS

    tgbus.com

    10.4Maccounts

    Breached 1 Sep 2017 Disclosed 28 Apr 2018

    Have I Been Pwned Unverified

    • Email addresses
    • Passwords
    • Usernames

    In approximately 2017, it's alleged that the Chinese gaming site known as TGBUS suffered a data breach that impacted over 10 million unique subscribers. Whilst there is evidence that the data is legitimate, due to the difficulty of emphatically verifying the Chinese breach it has been flagged as "unverified". The data in the breach contains usernames, email addresses and salted MD5 password hashes and was provided with support from dehashed.com. Read more about Chinese data breaches in Have I Been Pwned.
20. I

    ILikeCheats

    ilikecheats.net

    188.8Kaccounts

    Breached 18 Oct 2014 Disclosed 22 Apr 2018

    Have I Been Pwned Verified

    • Email addresses
    • IP addresses
    • Passwords
    • Usernames

    In October 2014, the game cheats website known as ILikeCheats suffered a data breach that exposed 189k accounts. The vBulletin based forum leaked usernames, IP and email addresses and weak MD5 hashes of passwords. The data was provided with support from dehashed.com.
21. C

    CashCrate

    cashcrate.com

    6.8Maccounts

    Breached 17 Nov 2016 Disclosed 20 Apr 2018

    Have I Been Pwned Verified

    • Email addresses
    • Names
    • Passwords
    • Physical addresses

    In June 2017, news broke that CashCrate had suffered a data breach exposing 6.8 million records. The breach of the cash-for-surveys site dated back to November 2016 and exposed names, physical addresses, email addresses and passwords stored in plain text for older accounts along with weak MD5 hashes for newer ones.
22. T

    Taringa

    taringa.net

    28Maccounts

    Breached 1 Aug 2017 Disclosed 19 Apr 2018

    Have I Been Pwned Verified

    • Email addresses
    • Passwords
    • Usernames

    In September 2017, news broke that Taringa had suffered a data breach exposing 28 million records. Known as "The Latin American Reddit", Taringa's breach disclosure notice indicated the incident dated back to August that year. The exposed data included usernames, email addresses and weak MD5 hashes of passwords.
23. S

    Smogon

    smogon.com

    386.5Kaccounts

    Breached 10 Sep 2017 Disclosed 11 Apr 2018

    Have I Been Pwned Verified

    • Email addresses
    • Genders
    • Geographic locations
    • Passwords
    • Usernames
    • Website activity

    In April 2018, the Pokémon website known as Smogon announced they'd suffered a data breach. The breach dated back to September 2017 and affected their XenForo based forum. The exposed data included usernames, email addresses, genders and both bcrypt and MD5 password hashes.
24. H

    HiAPK

    hiapk.com

    13.9Maccounts

    Breached 1 Jan 2014 Disclosed 1 Apr 2018

    Have I Been Pwned Unverified

    • Email addresses
    • Passwords
    • Usernames

    In approximately 2014, it's alleged that the Chinese Android store known as HIAPK suffered a data breach that impacted 13.8 million unique subscribers. Whilst there is evidence that the data is legitimate, due to the difficulty of emphatically verifying the Chinese breach it has been flagged as "unverified". The data in the breach contains usernames, email addresses and salted MD5 password hashes and was provided to HIBP by white hat security researcher and data analyst Adam Davies. Read more about Chinese data breaches in Have I Been Pwned.
25. March 2018
26. B

    Bestialitysextaboo

    bestialitysextaboo.com

    3.2Kaccounts

    Breached 19 Mar 2018 Disclosed 29 Mar 2018

    Have I Been Pwned Verified Sensitive

    • Dates of birth
    • Email addresses
    • Genders
    • Geographic locations
    • IP addresses
    • Passwords
    • Private messages
    • +1 more

    In March 2018, the animal bestiality website known as Bestialitysextaboo was hacked. A collection of various sites running on the same service were also compromised and details of the hack (including links to the data) were posted on a popular forum. In all, more than 3.2k unique email addresses were included alongside usernames, IP addresses, dates of birth, genders and bcrypt hashes of passwords.
27. M

    MDPI

    mdpi.com

    845Kaccounts

    Breached 30 Aug 2016 Disclosed 26 Mar 2018

    Have I Been Pwned Verified

    • Email addresses
    • Email messages
    • IP addresses
    • Names

    In August 2016, the Swiss scholarly open access publisher known as MDPI had 17.5GB of data obtained from an unprotected Mongo DB instance. The data contained email exchanges between MDPI and their authors and reviewers which included 845k unique email addresses. MDPI have confirmed that the system has since been protected and that no data of a sensitive nature was impacted. As such, they concluded that notification to their subscribers was not necessary due to the fact that all their authors and reviewers are available online on their website.
28. F

    Florida Virtual School

    flvs.net

    542.9Kaccounts

    Breached 12 Feb 2018 Disclosed 18 Mar 2018

    Have I Been Pwned Verified Sensitive

    • Dates of birth
    • Email addresses
    • Names
    • Passwords
    • School grades (class levels)
    • Usernames

    In March 2018, the Florida Virtual School (FLVS) posted a data breach notification to their website. The school had identified a data breach which had occurred sometime between 6 May 2016 and 12 Feb 2018 and an XML file containing 368k student records was subsequently found circulating. Each record contained student name, date of birth, password, grade, email and parent email resulting in a total of 543k unique email addresses. Due to the prevalence of email addresses belonging to individuals who are still legally children, the data breach has been flagged as "sensitive".
29. M

    MangaFox.me

    mangafox.me

    1.3Maccounts

    Breached 1 Jun 2016 Disclosed 17 Mar 2018

    Have I Been Pwned Verified

    • Dates of birth
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames

    In approximately July 2016, the manga website known as mangafox.me suffered a data breach. The vBulletin based forum exposed 1.3 million accounts including usernames, email and IP addresses, dates of birth and salted MD5 password hashes.

Breach records: Have I Been Pwned (CC BY 4.0), the HHS OCR breach portal, the Washington State Attorney General and the California Attorney General breach registers (public records). Last synced 21 hours ago.