Data Breaches

Check your email or password

Find out whether your email address or a password are leaked somewhere.

Check your email address or password…

  1. Shotbow

    shotbow.net
    1.1Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Usernames
    In May 2016, the multiplayer server for Minecraft service Shotbow announced they'd suffered a data breach. The incident resulted in the exposure of over 1 million unique email addresses, usernames and salted SHA-256 password hashes.

  2. Master Deeds

    2.3Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Deceased statuses
    • Email addresses
    • Employers
    • Ethnicities
    • Genders
    • Government issued IDs
    • +6 more
    In March 2017, a 27GB database backup file named "Master Deeds" was sent to HIBP by a supporter of the project. Upon detailed analysis later that year, the file was found to contain the personal data of tens of millions of living and deceased South African residents. The data included extensive personal attributes such as names, addresses, ethnicities, genders, birth dates, government issued personal identification numbers and 2.2 million email addresses. At the time of publishing, it's alleged the data was sourced from Dracore Data Sciences (Dracore is yet to publicly confirm or deny the data was sourced from their systems). On 18 October 2017, the file was found to have been published to a publicly accessible web server where it was located at the root of an IP address with directory listing enabled. The file was dated 8 April 2015.

  3. We Heart It

    weheartit.com
    8.6Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Usernames
    In November 2013, the image-based social network We Heart It suffered a data breach. The incident wasn't discovered until October 2017 when 8.6 million user records were sent to HIBP. The data contained user names, email addresses and password hashes, 80% of which were salted SHA-256 with the remainder being MD5 with no salt.

  4. diet.com

    diet.com
    1.4Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Eating habits
    • Email addresses
    • IP addresses
    • Names
    • Passwords
    • Physical attributes
    • +1 more
    In August 2014, the diet and nutrition website diet.com suffered a data breach resulting in the exposure of 1.4 million unique user records dating back as far as 2004. The data contained email and IP addresses, usernames, plain text passwords and dietary information about the site members including eating habits, BMI and birth date. The site was previously reported as compromised on the Vigilante.pw breached database directory.

  5. Victory Phones

    victoryphones.com
    166Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • IP addresses
    • Names
    • Phone numbers
    • Physical addresses
    In January 2017, the automated telephony services company Victory Phones left a Mongo DB database publicly facing without a password. Subsequently, 213GB of data was downloaded by an unauthorised party including names, addresses, phone numbers and over 166k unique email addresses.

  6. AbuseWith.Us

    abusewith.us
    1.4Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In 2016, the site dedicated to helping people hack email and online gaming accounts known as Abusewith.us suffered multiple data breaches. The site allegedly had an administrator in common with the nefarious LeakedSource site, both of which have since been shut down. The exposed data included more than 1.3 million unique email addresses, often accompanied by usernames, IP addresses and plain text or hashed passwords retrieved from various sources and intended to be used to compromise the victims' accounts.

  7. Disqus

    disqus.com
    17.6Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Usernames
    In October 2017, the blog commenting service Disqus announced they'd suffered a data breach. The breach dated back to July 2012 but wasn't identified until years later when the data finally surfaced. The breach contained over 17.5 million unique email addresses and usernames. Users who created logins on Disqus had salted SHA1 hashes of passwords whilst users who logged in via social providers only had references to those accounts.

  8. Kickstarter

    kickstarter.com
    5.2Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    In February 2014, the crowdfunding platform Kickstarter announced they'd suffered a data breach. The breach contained almost 5.2 million unique email addresses, usernames and salted SHA1 hashes of passwords.

  9. Bitly

    bitly.com
    9.3Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Usernames
    In May 2014, the link management company Bitly announced they'd suffered a data breach. The breach contained over 9.3 million unique email addresses, usernames and hashed passwords, most using SHA1 with a small number using bcrypt.

  11. Staminus

    staminus.net
    26.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Credit cards
    • Email addresses
    • IP addresses
    • Passwords
    • Support tickets
    • Usernames
    In March 2016, the DDoS protection service Staminus was "massively hacked" resulting in an outage of more than 20 hours and the disclosure of customer credentials (with unsalted MD5 hashes), support tickets, credit card numbers and other sensitive data. 27k unique email addresses were found in the data which was subsequently released to the public. Staminus is no longer in operation.

  12. AKP Emails

    akparti.org.tr
    917.5Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Email messages
    In July 2016, a hacker known as Phineas Fisher hacked Turkey's ruling party (Justice and Development Party or "AKP") and gained access to 300k emails. The full contents of the emails were subsequently published by WikiLeaks and made searchable. HIBP identified over 917k unique email address patterns in the data set, including message IDs and a number of other non-user addresses.

  13. 7k7k

    7k7k.com
    9.1Maccounts
    Breached Disclosed
    Have I Been Pwned Unverified
    • Email addresses
    • Passwords
    • Usernames
    In approximately 2011, it's alleged that the Chinese gaming site known as 7k7k suffered a data breach that impacted 9.1 million subscribers. Whilst there is evidence that the data is legitimate, due to the difficulty of emphatically verifying the Chinese breach it has been flagged as "unverified". The data in the breach contains usernames, email addresses and plain text passwords. Read more about Chinese data breaches in Have I Been Pwned.

  14. Zomato

    zomato.com
    16.5Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Usernames
    In May 2017, the restaurant guide website Zomato was hacked resulting in the exposure of almost 17 million accounts. The data was consequently redistributed online and contains email addresses, usernames and salted MD5 hashes of passwords (the password hash was not present on all accounts). This data was provided to HIBP by whitehat security researcher and data analyst Adam Davies.

  15. MALL.cz

    mall.cz
    735.4Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    • Phone numbers
    In July 2017, the Czech Republic e-commerce site MALL.cz suffered a data breach after which 735k unique accounts including email addresses, names, phone numbers and passwords were later posted online. Whilst passwords were stored as hashes, a number of different algorithms of varying strength were used over time. All passwords included in the publicly distributed data were in plain text and were likely just those that had been successfully cracked (members with strong passwords don't appear to be included). According to MALL.cz, the breach only impacted accounts created before 2015.

  16. Biohack.me

    biohack.me
    3.4Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Private messages
    • Usernames
    In December 2016, the forum for the biohacking website Biohack.me suffered a data breach that exposed 3.4k accounts. The data included usernames, email addresses and hashed passwords along with the private messages of forum members. The data was self-submitted to HIBP by the Biohack.me operators.

  17. Bin Weevils

    binweevils.com
    1.3Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Ages
    • Email addresses
    • Genders
    • IP addresses
    • Passwords
    • Usernames
    In September 2014, the online game Bin Weevils suffered a data breach. Whilst originally stating that only usernames and passwords had been exposed, a subsequent story on DataBreaches.net indicated that a more extensive set of personal attributes were impacted (comments there also suggest the data may have come from a later breach). Data matching that pattern was later provided to Have I Been Pwned by @akshayindia6 and included almost 1.3m unique email addresses, genders, ages and plain text passwords.

  18. Dailymotion

    dailymotion.com
    85.2Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Usernames
    In October 2016, the video sharing platform Dailymotion suffered a data breach. The attack led to the exposure of more than 85 million user accounts and included email addresses, usernames and bcrypt hashes of passwords.

  19. MCBans

    mcbans.com
    119.9Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    • Website activity
    In October 2016, the Minecraft banning service known as MCBans suffered a data breach resulting in the exposure of 120k unique user records. The data contained email and IP addresses, usernames and password hashes of unknown format. The site was previously reported as compromised on the Vigilante.pw breached database directory.

  20. Evermotion

    evermotion.org
    435.5Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Passwords
    • Usernames
    In May 2015, the Polish 3D modelling website known as Evermotion suffered a data breach resulting in the exposure of 435k unique user records. The data was sourced from a vBulletin forum and contained email addresses, usernames, dates of birth and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory.

  21. Programming Forums

    programmingforums.org
    707.4Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In approximately late 2015, the programming forum at programmingforums.org suffered a data breach resulting in the exposure of 707k unique user records. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory.

  22. Powerbot

    powerbot.org
    503.5Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In approximately September 2014, the RuneScape bot website Powerbot suffered a data breach resulting in the exposure of over half a million unique user records. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory.

  23. XPG

    xpgamesaves.com
    890.3Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In approximately early 2016, the gaming website Xpgamesaves (XPG) suffered a data breach resulting in the exposure of 890k unique user records. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory. This data was provided by security researcher and data analyst, Adam Davies.

  24. Coachella

    coachella.com
    599.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In February 2017, hundreds of thousands of records from the Coachella music festival were discovered being sold online. Allegedly taken from a combination of the main Coachella website and their vBulletin-based message board, the data included almost 600k usernames, IP and email addresses and salted hashes of passwords (MD5 in the case of the message board).

Breach records: Have I Been Pwned (CC BY 4.0), the HHS OCR breach portal, the Washington State Attorney General and the California Attorney General breach registers (public records). Last synced 19 hours ago.