Data Breaches

Check your email or password

Find out whether your email address or a password are leaked somewhere.

Check your email address or password…

  2. 2,844 Separate Data Breaches

    80.1Maccounts
    Breached Disclosed
    Have I Been Pwned Unverified
    • Email addresses
    • Passwords
    In February 2018, a massive collection of almost 3,000 alleged data breaches was found online. Whilst some of the data had previously been seen in Have I Been Pwned, 2,844 of the files consisting of more than 80 million unique email addresses had not previously been seen. Each file contained both an email address and plain text password and were consequently loaded as a single "unverified" data breach.

  3. Underworld Empire

    underworldempireforums.com
    428.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In April 2017, the vBulletin forum for the Underworld Empire game suffered a data breach that exposed 429k accounts. The data was then posted to a hacking forum in mid-February 2018 where it was made available to download. The source data contained IP and email addresses, usernames and salted MD5 hashes.

  4. 8tracks

    8tracks.com
    18Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    In June 2017, the online playlists service known as 8Tracks suffered a data breach which impacted 18 million accounts. In their disclosure, 8Tracks advised that "the vector for the attack was an employee’s GitHub account, which was not secured using two-factor authentication". Salted SHA-1 password hashes for users who didn't sign up with either Google or Facebook authentication were also included. The data was provided to HIBP by whitehat security researcher and data analyst Adam Davies and contained almost 8 million unique email addresses. The complete set of 18M records was later provided by [email protected] and updated in HIBP accordingly.

  5. Guns and Robots

    play-gar.com
    143.6Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In approximately April 2016, the gaming website Guns and Robots suffered a data breach resulting in the exposure of 143k unique records. The data contained email and IP addresses, usernames and SHA-1 password hashes. The site was previously reported as compromised on the Vigilante.pw breached database directory.

  7. TheTVDB.com

    thetvdb.com
    181.9Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Usernames
    In November 2017, the open television database known as TheTVDB.com suffered a data breach. The breached data was posted to a hacking forum and included 182k records with usernames, email addresses and MySQL password hashes.

  8. The Fly on the Wall

    theflyonthewall.com
    84Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Age groups
    • Credit cards
    • Email addresses
    • Genders
    • Names
    • Passwords
    • Phone numbers
    • +3 more
    In December 2017, the stock market news website The Fly on the Wall suffered a data breach. The data in the breach included 84k unique email addresses as well as purchase histories and credit card data. Numerous attempts were made to contact The Fly on the Wall about the incident, however no responses were received.

  10. Open CS:GO

    opencsgo.com
    512.3Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Avatars
    • Email addresses
    • IP addresses
    • Phone numbers
    • Physical addresses
    • Purchases
    • Social media profiles
    • +1 more
    In December 2017, the website for purchasing Counter-Strike skins known as Open CS:GO (Counter-Strike: Global Offensive) suffered a data breach (address since redirects to dropgun.com). The 10GB file contained an extensive amount of personal information including email and IP addresses, phone numbers, physical addresses and purchase histories. Numerous attempts were made to contact Open CS:GO about the incident, however no responses were received.

  11. 2fast4u

    2fast4u.be
    17.7Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Usernames
    In December 2017, the Belgian motorcycle forum 2fast4u discovered a data breach of their system. The breach of the vBulletin message board impacted over 17k individual users and exposed email addresses, usersnames and salted MD5 passwords.

  12. HoundDawgs

    hounddawgs.org
    45.7Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Website activity
    In December 2017, the Danish torrent tracker known as HoundDawgs suffered a data breach. More than 55GB of data was dumped publicly and whilst there was initially contention as to the severity of the incident, the data did indeed contain more than 45k unique email addresses complete extensive logs of torrenting activity, IP addresses and SHA1 passwords.

  13. Ancestry

    ancestry.com
    297.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    In November 2015, an Ancestry service known as RootsWeb suffered a data breach. The breach was not discovered until late 2017 when a file containing almost 300k email addresses and plain text passwords was identified.

  14. CrackingForum

    crackingforum.com
    660.3Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In approximately mid-2016, the cracking community forum known as CrackingForum suffered a data breach. The vBulletin based forum exposed 660k email and IP addresses, usernames and salted MD5 hashes.

  15. dvd-shop.ch

    dvd-shop.ch
    68Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    In December 2017, the online Swiss DVD store known as dvd-shop.ch suffered a data breach. The incident led to the exposure of 68k email addresses and plain text passwords. The site has since been updated to indicate that it is currently closed.

  16. Netshoes

    netshoes.com.br
    499.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Names
    • Purchases
    In December 2017, the online Brazilian retailer known as Netshoes had half a million records allegedly hacked from their system posted publicly. The company was contacted by local Brazilian media outlet Tecmundo and subsequently advised that no indications have been identified of an invasion of the company's systems. However, Netshoes' own systems successfully confirm the presence of matching identifiers and email addresses from the data set, indicating a high likelihood that the data originated from them.

  17. ai.type

    aitype.com
    20.6Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Address book contacts
    • Apps installed on devices
    • Cellular network names
    • Dates of birth
    • Device information
    • Email addresses
    • Genders
    • +8 more
    In December 2017, the virtual keyboard application ai.type was found to have left a huge amount of data publicly facing in an unsecured MongoDB instance. Discovered by researchers at The Kromtech Security Center, the 577GB data set included extensive personal information including over 20 million unique email addresses, social media profiles and address book contacts. The email addresses alone were provided to HIBP to enable impacted users to assess their exposure.

  18. imgur

    imgur.com
    1.7Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    In September 2013, the online image sharing community imgur suffered a data breach. A selection of the data containing 1.7 million email addresses and passwords surfaced more than 4 years later in November 2017. Although imgur stored passwords as SHA-256 hashes, the data in the breach contained plain text passwords suggesting that many of the original hashes had been cracked. imgur advises that they rolled over to bcrypt hashes in 2016.

  19. Bolt

    bolt.cd
    995.3Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In approximately March 2017, the file sharing website Bolt suffered a data breach resulting in the exposure of 995k unique user records. The data was sourced from their vBulletin forum and contained email and IP addresses, usernames and salted MD5 password hashes. The site was previously reported as compromised on the Vigilante.pw breached database directory.

  20. V-Tight Gel

    vtightgel.com
    2Maccounts
    Breached Disclosed
    Have I Been Pwned Unverified Sensitive
    • Email addresses
    • IP addresses
    • Names
    • Phone numbers
    • Physical addresses
    In approximately February 2016, data surfaced which was allegedly obtained from V-Tight Gel (vaginal tightening gel). Whilst the data set was titled V-Tight, within there were 50 other (predominantly wellness-related) domain names, most owned by the same entity. Multiple HIBP subscribers confirmed that although they couldn't recall providing data specifically to V-Tight, their personal information including name, phone and physical address was accurate. V-Tight Gel did not reply to multiple requests for comment.

  21. PoliceOne

    policeone.com
    709.9Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In February 2017, the law enforcement website PoliceOne confirmed they'd suffered a data breach. The breach contained over 700k accounts which appeared for sale by a data broker and included email and IP addresses, usernames and salted MD5 password hashes. The file the data was contained in indicated the original breach dated back to July 2014.

  22. Coupon Mom / Armor Games

    11Maccounts
    Breached Disclosed
    Have I Been Pwned Unverified
    • Email addresses
    • Passwords
    In 2014, a file allegedly containing data hacked from Coupon Mom was created and included 11 million email addresses and plain text passwords. On further investigation, the file was also found to contain data indicating it had been sourced from Armor Games. Subsequent verification with HIBP subscribers confirmed the passwords had previously been used and many subscribers had used either Coupon Mom or Armor Games in the past. On disclosure to both organisations, each found that the data did not represent their entire customer base and possibly includes records from other sources with common subscribers. The breach has subsequently been flagged as "unverified" as the source cannot be emphatically proven. In July 2020, the data was also found to contain BeerAdvocate accounts sourced from a previously unknown breach.

  23. CafeMom

    cafemom.com
    2.6Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    In 2014, the social network for mothers CafeMom suffered a data breach. The data surfaced alongside a number of other historical breaches including Kickstarter, Bitly and Disqus and contained 2.6 million email addresses and plain text passwords.

  24. JobStreet

    jobstreet.com
    3.9Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Genders
    • Geographic locations
    • Government issued IDs
    • Marital statuses
    • Names
    • +5 more
    In October 2017, the Malaysian website lowyat.net ran a story on a massive set of breached data affecting millions of Malaysians after someone posted it for sale on their forums. The data spanned multiple separate breaches including the JobStreet jobs website which contained almost 4 million unique email addresses. The dates in the breach indicate the incident occurred in March 2012. The data later appeared freely downloadable on a Tor hidden service and contained extensive information on job seekers including names, genders, birth dates, phone numbers, physical addresses and passwords.

Breach records: Have I Been Pwned (CC BY 4.0), the HHS OCR breach portal, the Washington State Attorney General and the California Attorney General breach registers (public records). Last synced 19 hours ago.