Data Breaches

Check your email or password

Find out whether your email address or a password are leaked somewhere.

Check your email address or password…

  1. gPotato

    gpotato.com
    2.1Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Genders
    • IP addresses
    • Names
    • Passwords
    • Physical addresses
    • +3 more
    In July 2007, the multiplayer game portal known as gPotato (link to archive of the site at that time) suffered a data breach and over 2 million user accounts were exposed. The site later merged into the Webzen portal where the original accounts still exist today. The exposed data included usernames, email and IP addresses, MD5 hashes and personal attributes such as gender, birth date, physical address and security questions and answers stored in plain text.

  2. GameTuts

    game-tuts.com
    2.1Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    Likely in early 2015, the video game website GameTuts suffered a data breach and over 2 million user accounts were exposed. The site later shut down in July 2016 but was identified as having been hosted on a vBulletin forum. The exposed data included usernames, email and IP addresses and salted MD5 hashes.

  3. Last.fm

    last.fm
    37.2Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Usernames
    • Website activity
    In March 2012, the music website Last.fm was hacked and 43 million user accounts were exposed. Whilst Last.fm knew of an incident back in 2012, the scale of the hack was not known until the data was released publicly in September 2016. The breach included 37 million unique email addresses, usernames and passwords stored as unsalted MD5 hashes.

  4. MoDaCo

    modaco.com
    879.7Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In approximately January 2016, the UK based Android community known as MoDaCo suffered a data breach which exposed 880k subscriber identities. The data included email and IP addresses, usernames and passwords stored as salted MD5 hashes.

  5. eThekwini Municipality

    eservices.durban.gov.za
    81.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Deceased date
    • Email addresses
    • Genders
    • Government issued IDs
    • Names
    • Passport numbers
    • +4 more
    In September 2016, the new eThekwini eServices website in South Africa was launched with a number of security holes that lead to the leak of over 98k residents' personal information and utility bills across 82k unique email addresses. Emails were sent prior to launch containing passwords in plain text and the site allowed anyone to download utility bills without sufficient authentication. Various methods of customer data enumeration was possible and phishing attacks began appearing the day after launch.

  6. Regpack

    bluesnap.com
    105Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Browser user agent details
    • Credit card CVV
    • Email addresses
    • IP addresses
    • Names
    • Partial credit card data
    • Phone numbers
    • +2 more
    In July 2016, a tweet was posted with a link to an alleged data breach of BlueSnap, a global payment gateway and merchant account provider. The data contained 324k payment records across 105k unique email addresses and included personal attributes such as name, home address and phone number. The data was verified with multiple Have I Been Pwned subscribers who confirmed it also contained valid transactions, partial credit card numbers, expiry dates and CVVs. A downstream consumer of BlueSnap services known as Regpack was subsequently identified as the source of the data after they identified human error had left the transactions exposed on a publicly facing server. A full investigation of the data and statement by Regpack is detailed in the post titled Someone just lost 324k payment records, complete with CVVs.

  7. ClixSense

    clixsense.com
    2.4Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Account balances
    • Dates of birth
    • Email addresses
    • Genders
    • IP addresses
    • Names
    • Passwords
    • +5 more
    In September 2016, the paid-to-click site ClixSense suffered a data breach which exposed 2.4 million subscriber identities. The breached data was then posted online by the attackers who claimed it was a subset of a larger data breach totalling 6.6 million records. The leaked data was extensive and included names, physical, email and IP addresses, genders and birth dates, account balances and passwords stored as plain text.

  8. Pokébip

    pokebip.com
    657Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Time zones
    • Usernames
    • Website activity
    In July 2015, the French Pokémon site Pokébip suffered a data breach which exposed 657k subscriber identities. The data included email and IP addresses, usernames and passwords stored as unsalted MD5 hashes.

  9. DLH.net

    dlh.net
    3.3Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Names
    • Passwords
    • Usernames
    • Website activity
    In July 2016, the gaming news site DLH.net suffered a data breach which exposed 3.3M subscriber identities. Along with the keys used to redeem and activate games on the Steam platform, the breach also resulted in the exposure of email addresses, birth dates and salted MD5 password hashes. The data was donated to Have I Been Pwned by data breach monitoring service Vigilante.pw.

  10. Experian (2015)

    experian.com
    7.2Maccounts
    Breached Disclosed
    Have I Been Pwned Unverified
    • Credit status information
    • Dates of birth
    • Email addresses
    • Ethnicities
    • Family structure
    • Genders
    • Home ownership statuses
    • +6 more
    In September 2015, the US based credit bureau and consumer data broker Experian suffered a data breach that impacted 15 million customers who had applied for financing from T-Mobile. An alleged data breach was subsequently circulated containing personal information including names, physical and email addresses, birth dates and various other personal attributes. Multiple Have I Been Pwned subscribers verified portions of the data as being accurate, but the actual source of it was inconclusive therefor this breach has been flagged as "unverified".

  11. Flash Flash Revolution (2016 breach)

    flashflashrevolution.com
    1.8Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Usernames
    In February 2016, the music-based rhythm game known as Flash Flash Revolution was hacked and 1.8M accounts were exposed. Along with email and IP addresses, the vBulletin forum also exposed salted MD5 password hashes.

  12. Onverse

    onverse.com
    800.2Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In January 2016, the online virtual world known as Onverse was hacked and 800k accounts were exposed. Along with email and IP addresses, the site also exposed salted MD5 password hashes.

  13. WIIU ISO

    wiiuiso.com
    458.2Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In September 2015, the Nintendo Wii U forum known as WIIU ISO was hacked and 458k accounts were exposed. Along with email and IP addresses, the vBulletin forum also exposed salted MD5 password hashes.

  14. ServerPact

    serverpact.com
    73.6Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In mid-2015, the Dutch Minecraft site ServerPact was hacked and 73k accounts were exposed. Along with birth dates, email and IP addresses, the site also exposed SHA1 password hashes with the username as the salt.

  15. Brazzers

    brazzers.com
    790.7Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified Sensitive
    • Email addresses
    • Passwords
    • Usernames
    In April 2013, the adult website known as Brazzers was hacked and 790k accounts were exposed publicly. Each record included a username, email address and password stored in plain text. The breach was brought to light by the Vigilante.pw data breach reporting site in September 2016.

  16. Dropbox

    dropbox.com
    68.6Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    In mid-2012, Dropbox suffered a data breach which exposed the stored credentials of tens of millions of their customers. In August 2016, they forced password resets for customers they believed may be at risk. A large volume of data totalling over 68 million records was subsequently traded online and included email addresses and salted hashes of passwords (half of them SHA1, half of them bcrypt).

  17. InterPals

    interpals.net
    3.4Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Geographic locations
    • Names
    • Passwords
    • Usernames
    In late 2015, the online penpal site InterPals had their website hacked and 3.4 million accounts exposed. The compromised data included email addresses, geographical locations, birthdates and salted hashes of passwords.

  18. Nihonomaru

    nihonomaru.net
    1.7Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In late 2015, the anime community known as Nihonomaru had their vBulletin forum hacked and 1.7 million accounts exposed. The compromised data included email and IP addresses, usernames and salted hashes of passwords.

  19. Minecraft World Map

    minecraftworldmap.com
    71.1Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    In approximately January 2016, the Minecraft World Map site designed for sharing maps created for the game was hacked and over 71k user accounts were exposed. The data included usernames, email and IP addresses along with salted and hashed passwords.

  20. GTAGaming

    gtagaming.com
    197.2Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    • Website activity
    In August 2016, the Grand Theft Auto forum GTAGaming was hacked and nearly 200k user accounts were leaked. The vBulletin based forum included usernames, email addresses and password hashes.

  21. Teracod

    teracod.org
    97.2Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Avatars
    • Email addresses
    • IP addresses
    • Passwords
    • Payment histories
    • Private messages
    • Usernames
    • +1 more
    In May 2015, almost 100k user records were extracted from the Hungarian torrent site known as Teracod. The data was later discovered being torrented itself and included email addresses, passwords, private messages between members and the peering history of IP addresses using the service.

  22. xat

    xat.com
    6Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    • Website activity
    In November 2015, the online chatroom known as "xat" was hacked and 6 million user accounts were exposed. Used as a chat engine on websites, the leaked data included usernames, email and IP addresses along with hashed passwords.

  23. Warframe

    warframe.com
    819.5Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Usernames
    • Website activity
    In November 2014, the online game Warframe was hacked and 819k unique email addresses were exposed. Allegedly due to a SQL injection flaw in Drupal, the attack exposed usernames, email addresses and data in a "pass" column which adheres to the salted SHA12 password hashing pattern used by Drupal 7. Digital Extremes (the developers of Warframe), asserts the salted hashes are of "alias names" rather than passwords.

  24. Trillian

    trillian.im
    3.8Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • IP addresses
    • Names
    • Passwords
    • Usernames
    In December 2015, the instant messaging application Trillian suffered a data breach. The breach became known in July 2016 and exposed various personal data attributes including names, email addresses and passwords stored as salted MD5 hashes.

Breach records: Have I Been Pwned (CC BY 4.0), the HHS OCR breach portal, the Washington State Attorney General and the California Attorney General breach registers (public records). Last synced 17 hours ago.