Data Breaches

1. June 2017
2. E

   Exposed VINs

   396.7Kaccounts

   Breached 5 Jun 2017 Disclosed 9 Jun 2017

   Have I Been Pwned Unverified

   • Dates of birth
   • Email addresses
   • Family structure
   • Genders
   • Names
   • Phone numbers
   • Physical addresses
   • +1 more

   In June 2017, an unsecured database with more than 10 million VINs (vehicle identification numbers) was discovered by researchers. Believed to be sourced from US car dealerships, the data included a raft of personal information and vehicle data along with 397k unique email addresses.
3. D

   Data Enrichment Records

   8.2Maccounts

   Breached 23 Dec 2016 Disclosed 8 Jun 2017

   Have I Been Pwned Unverified

   • Buying preferences
   • Charitable donations
   • Credit status information
   • Dates of birth
   • Email addresses
   • Family structure
   • Financial investments
   • +9 more

   In December 2016, more than 200 million "data enrichment profiles" were found for sale on the darknet. The seller claimed the data was sourced from Experian and whilst that claim was rejected by the company, the data itself was found to be legitimate suggesting it may have been sourced from other legitimate locations. In total, there were more than 8 million unique email addresses in the data which also contained a raft of other personal attributes including credit ratings, home ownership status, family structure and other fields described in the story linked to above. The email addresses alone were provided to HIBP.
4. A

   Abandonia (2015)

   abandonia.com

   776.1Kaccounts

   Breached 1 Nov 2015 Disclosed 5 Jun 2017

   Have I Been Pwned Verified

   • Email addresses
   • IP addresses
   • Passwords
   • Usernames

   In November 2015, the gaming website dedicated to classic DOS games Abandonia suffered a data breach resulting in the exposure of 776k unique user records. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords.
5. E

   Edmodo

   edmodo.com

   43.4Maccounts

   Breached 11 May 2017 Disclosed 1 Jun 2017

   Have I Been Pwned Verified

   • Email addresses
   • Passwords
   • Usernames

   In May 2017, the education platform Edmodo was hacked resulting in the exposure of 77 million records comprised of over 43 million unique customer email addresses. The data was consequently published to a popular hacking forum and made freely available. The records in the breach included usernames, email addresses and bcrypt hashes of passwords.
6. May 2017
7. D

   DaFont

   dafont.com

   637.3Kaccounts

   Breached 16 May 2017 Disclosed 18 May 2017

   Have I Been Pwned Verified

   • Email addresses
   • Passwords
   • Usernames

   In May 2017, font sharing site DaFont suffered a data breach resulting in the exposure of 637k records. Allegedly due to a SQL injection vulnerability exploited by multiple parties, the exposed data included usernames, email addresses and passwords stored as MD5 without a salt.
8. B

   Bell (2017 breach)

   bell.ca

   2.2Maccounts

   Breached 15 May 2017 Disclosed 16 May 2017

   Have I Been Pwned Verified

   • Email addresses
   • Geographic locations
   • IP addresses
   • Job titles
   • Names
   • Passwords
   • Phone numbers
   • +3 more

   In May 2017, the Bell telecommunications company in Canada suffered a data breach resulting in the exposure of millions of customer records. The data was consequently leaked online with a message from the attacker stating that they were "releasing a significant portion of Bell.ca's data due to the fact that they have failed to cooperate with us" and included a threat to leak more. The impacted data included over 2 million unique email addresses and 153k survey results dating back to 2011 and 2012. There were also 162 Bell employee records with more comprehensive personal data including names, phone numbers and plain text "passcodes". Bell suffered another breach in 2014 which exposed 40k records.
9. E

   Exploit.In

   593.4Maccounts

   Breached 13 Oct 2016 Disclosed 6 May 2017

   Have I Been Pwned Unverified

   • Email addresses
   • Passwords

   In late 2016, a huge list of email address and password pairs appeared in a "combo list" referred to as "Exploit.In". The list contained 593 million unique email addresses, many with multiple different passwords hacked from various online systems. The list was broadly circulated and used for "credential stuffing", that is attackers employ it in an attempt to identify other online systems where the account owner had reused their password. For detailed background on this incident, read Password reuse, credential stuffing and another billion records in Have I Been Pwned.
10. A

    Anti Public Combo List

    458Maccounts

    Breached 16 Dec 2016 Disclosed 5 May 2017

    Have I Been Pwned Unverified

    • Email addresses
    • Passwords

    In December 2016, a huge list of email address and password pairs appeared in a "combo list" referred to as "Anti Public". The list contained 458 million unique email addresses, many with multiple different passwords hacked from various online systems. The list was broadly circulated and used for "credential stuffing", that is attackers employ it in an attempt to identify other online systems where the account owner had reused their password. For detailed background on this incident, read Password reuse, credential stuffing and another billion records in Have I Been Pwned.
11. April 2017
12. R

    Retina-X

    retinax.com

    71.2Kaccounts

    Breached 23 Feb 2017 Disclosed 30 Apr 2017

    Have I Been Pwned Verified Sensitive

    • Email addresses
    • Passwords

    In February 2017, the mobile device monitoring software developer Retina-X was hacked and customer data downloaded before being wiped from their servers. The incident was covered in the Motherboard article titled Inside the 'Stalkerware' Surveillance Market, Where Ordinary People Tap Each Other's Phones. The service, used to monitor mobile devices, had 71k email addresses and MD5 hashes with no salt exposed. Retina-X disclosed the incident in a blog post on April 27, 2017.
13. R

    R2 (2017 forum breach)

    r2games.com

    1Maccounts

    Breached 1 Jan 2017 Disclosed 25 Apr 2017

    Have I Been Pwned Verified

    • Email addresses
    • Passwords
    • Usernames
    • Website activity

    In early 2017, the forum for the gaming website R2 Games was hacked. R2 had previously appeared on HIBP in 2015 after a prior incident. This one exposed over 1 million unique user accounts and corresponding MD5 password hashes with no salt.
14. F

    FashionFantasyGame

    fashionfantasygame.com

    2.4Maccounts

    Breached 1 Dec 2016 Disclosed 20 Apr 2017

    Have I Been Pwned Verified

    • Email addresses
    • Passwords

    In late 2016, the fashion gaming website Fashion Fantasy Game suffered a data breach. The incident exposed 2.3 million unique user accounts and corresponding MD5 password hashes with no salt. The data was contributed to Have I Been Pwned courtesy of [email protected].
15. Y

    Youku

    youku.com

    91.9Maccounts

    Breached 1 Dec 2016 Disclosed 15 Apr 2017

    Have I Been Pwned Verified

    • Email addresses
    • Passwords

    In late 2016, the online Chinese video service Youku suffered a data breach. The incident exposed 92 million unique user accounts and corresponding MD5 password hashes. The data was contributed to Have I Been Pwned courtesy of [email protected].
16. H

    Health Now Networks

    healthnow.co

    321.9Kaccounts

    Breached 25 Mar 2017 Disclosed 7 Apr 2017

    Have I Been Pwned Verified

    • Dates of birth
    • Email addresses
    • Genders
    • Health insurance information
    • IP addresses
    • Names
    • Personal health data
    • +4 more

    In March 2017, the telemarketing service Health Now Networks left a database containing hundreds of thousands of medical records exposed. There were over 900,000 records in total containing significant volumes of personal information including names, dates of birth, various medical conditions and operator notes on the individuals' health. The data included over 320k unique email addresses.
17. March 2017
18. B

    Bitcoin Talk

    bitcointalk.org

    501.4Kaccounts

    Breached 22 May 2015 Disclosed 28 Mar 2017

    Have I Been Pwned Verified

    • Dates of birth
    • Email addresses
    • Genders
    • IP addresses
    • Passwords
    • Security questions and answers
    • Usernames
    • +1 more

    In May 2015, the Bitcoin forum Bitcoin Talk was hacked and over 500k unique email addresses were exposed. The attack led to the exposure of a raft of personal data including usernames, email and IP addresses, genders, birth dates, security questions and MD5 hashes of their answers plus hashes of the passwords themselves.
19. E

    Evony

    evony.com

    29.4Maccounts

    Breached 1 Jun 2016 Disclosed 26 Mar 2017

    Have I Been Pwned Verified

    • Email addresses
    • IP addresses
    • Passwords
    • Usernames

    In June 2016, the online multiplayer game Evony was hacked and over 29 million unique accounts were exposed. The attack led to the exposure of usernames, email and IP addresses and MD5 hashes of passwords (without salt).
20. H

    HLTV

    hltv.org

    611.1Kaccounts

    Breached 19 Jun 2016 Disclosed 22 Mar 2017

    Have I Been Pwned Verified

    • Email addresses
    • Names
    • Passwords
    • Usernames
    • Website activity

    In June 2016, the "home of competitive Counter Strike" website HLTV was hacked and 611k accounts were exposed. The attack led to the exposure of names, usernames, email addresses and bcrypt hashes of passwords.
21. S

    SweClockers.com

    sweclockers.com

    254.9Kaccounts

    Breached 1 Apr 2015 Disclosed 22 Mar 2017

    Have I Been Pwned Verified

    • Email addresses
    • Passwords
    • Usernames

    In early 2015, the Swedish tech news site SweClockers was hacked and 255k accounts were exposed. The attack led to the exposure of usernames, email addresses and salted hashes of passwords stored with a combination of MD5 and SHA512.
22. T

    Torrent Invites

    torrent-invites.com

    352.1Kaccounts

    Breached 12 Dec 2013 Disclosed 22 Mar 2017

    Have I Been Pwned Verified

    • Dates of birth
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    • Website activity

    In December 2013, the torrent site Torrent Invites was hacked and over 352k accounts were exposed. The vBulletin forum contained usernames, email and IP addresses, birth dates and salted MD5 hashes of passwords.
23. C

    CrimeAgency vBulletin Hacks

    942Kaccounts

    Breached 19 Jan 2017 Disclosed 21 Mar 2017

    Have I Been Pwned Verified Sensitive

    • Email addresses
    • Passwords
    • Usernames

    In January 2016, a large number of unpatched vBulletin forums were compromised by an actor known as "CrimeAgency". A total of 140 forums had data including usernames, email addresses and passwords (predominantly stored as salted MD5 hashes), extracted and then distributed. Refer to the complete list of the forums for further information on which sites were impacted.
24. S

    Soundwave

    soundwave.com

    130.7Kaccounts

    Breached 16 Jul 2015 Disclosed 17 Mar 2017

    Have I Been Pwned Verified

    • Dates of birth
    • Email addresses
    • Genders
    • Geographic locations
    • Names
    • Passwords
    • Social connections

    In approximately mid 2015, the music tracking app Soundwave suffered a data breach. The breach stemmed from an incident whereby "production data had been used to populate the test database" and was then inadvertently exposed in a MongoDB. The data contained 130k records and included email addresses, dates of birth, genders and MD5 hashes of passwords without a salt.
25. W

    Wishbone (2016)

    wishbone.io

    2.2Maccounts

    Breached 7 Aug 2016 Disclosed 15 Mar 2017

    Have I Been Pwned Verified

    • Auth tokens
    • Dates of birth
    • Email addresses
    • Genders
    • Names
    • Phone numbers
    • Usernames

    In August 2016, the mobile app to "compare anything" known as Wishbone suffered a data breach. The data contained 9.4 million records with 2.2 million unique email addresses and was allegedly a subset of the complete data set. The exposed data included genders, birthdates, email addresses and phone numbers for an audience predominantly composed of teenagers and young adults.
26. S

    Ster-Kinekor

    sterkinekor.co.za

    1.6Maccounts

    Breached 9 Mar 2017 Disclosed 13 Mar 2017

    Have I Been Pwned Verified

    • Dates of birth
    • Email addresses
    • Genders
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    • +1 more

    In 2016, the South African cinema company Ster-Kinekor had a security flaw which leaked a large amount of customer data via an enumeration vulnerability in the API of their old website. Whilst more than 6 million accounts were leaked by the flaw, the exposed data only contained 1.6 million unique email addresses. The data also included extensive personal information such as names, addresses, birthdates, genders and plain text passwords.
27. B

    BTC-E

    btc-e.com

    568.3Kaccounts

    Breached 1 Oct 2014 Disclosed 12 Mar 2017

    Have I Been Pwned Verified

    • Account balances
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    • Website activity

    In October 2014, the Bitcoin exchange BTC-E was hacked and 568k accounts were exposed. The data included email and IP addresses, wallet balances and hashed passwords.
28. L

    Little Monsters

    littlemonsters.com

    995.7Kaccounts

    Breached 1 Jan 2017 Disclosed 7 Mar 2017

    Have I Been Pwned Verified

    • Dates of birth
    • Email addresses
    • Passwords
    • Usernames

    In approximately January 2017, the Lady Gaga fan site known as "Little Monsters" suffered a data breach that impacted 1 million accounts. The data contained usernames, email addresses, dates of birth and bcrypt hashes of passwords.

Breach records: Have I Been Pwned (CC BY 4.0), the HHS OCR breach portal, the Washington State Attorney General and the California Attorney General breach registers (public records). Last synced 18 hours ago.