Data Breaches

1. July 2016
2. 1

   17

   17app.co

   4Maccounts

   Breached 19 Apr 2016 Disclosed 8 Jul 2016

   Have I Been Pwned Verified

   • Device information
   • Email addresses
   • IP addresses
   • Passwords
   • Usernames

   In April 2016, customer data obtained from the streaming app known as "17" appeared listed for sale on a Tor hidden service marketplace. The data contained over 4 million unique email addresses along with IP addresses, usernames and passwords stored as unsalted MD5 hashes.
3. N

   Neopets

   neopets.com

   26.9Maccounts

   Breached 5 May 2013 Disclosed 8 Jul 2016

   Have I Been Pwned Verified

   • Dates of birth
   • Email addresses
   • Genders
   • Geographic locations
   • IP addresses
   • Names
   • Passwords
   • +1 more

   In May 2016, a set of breached data originating from the virtual pet website "Neopets" was found being traded online. Allegedly hacked "several years earlier", the data contains sensitive personal information including birthdates, genders and names as well as almost 27 million unique email addresses. Passwords were stored in plain text and IP addresses were also present in the breach.
4. B

   Badoo

   badoo.com

   112Maccounts

   Breached 1 Jun 2013 Disclosed 6 Jul 2016

   Have I Been Pwned Unverified Sensitive

   • Dates of birth
   • Email addresses
   • Genders
   • Names
   • Passwords
   • Usernames

   In June 2016, a data breach allegedly originating from the social website Badoo was found to be circulating amongst traders. Likely obtained several years earlier, the data contained 112 million unique email addresses with personal data including names, birthdates and passwords stored as MD5 hashes. Whilst there are many indicators suggesting Badoo did indeed suffer a data breach, the legitimacy of the data could not be emphatically proven so this breach has been categorised as "unverified".
5. I

   iMesh

   imesh.com

   49.5Maccounts

   Breached 22 Sep 2013 Disclosed 2 Jul 2016

   Have I Been Pwned Verified

   • Email addresses
   • IP addresses
   • Passwords
   • Usernames

   In September 2013, the media and file sharing client known as iMesh was hacked and approximately 50M accounts were exposed. The data was later put up for sale on a dark market website in mid-2016 and included email and IP addresses, usernames and salted MD5 hashes.
6. June 2016
7. T

   Tianya

   tianya.cn

   29Maccounts

   Breached 26 Dec 2011 Disclosed 30 Jun 2016

   Have I Been Pwned Verified

   • Email addresses
   • Names
   • Usernames

   In December 2011, China's largest online forum known as Tianya was hacked and tens of millions of accounts were obtained by the attacker. The leaked data included names, usernames and email addresses.
8. M

   Muslim Match

   muslimmatch.com

   149.8Kaccounts

   Breached 24 Jun 2016 Disclosed 29 Jun 2016

   Have I Been Pwned Verified Sensitive

   • Chat logs
   • Email addresses
   • Geographic locations
   • IP addresses
   • Passwords
   • Private messages
   • User statuses
   • +1 more

   In June 2016, the Muslim Match dating website had 150k email addresses exposed. The data included private chats and messages between relationship seekers and numerous other personal attributes including passwords hashed with MD5.
9. W

   WHMCS

   whmcs.com

   134Kaccounts

   Breached 21 May 2012 Disclosed 29 Jun 2016

   Have I Been Pwned Verified

   • Email addresses
   • Email messages
   • Employers
   • IP addresses
   • Names
   • Partial credit card data
   • Passwords
   • +3 more

   In May 2012, the web hosting, billing and automation company WHMCS suffered a data breach that exposed 134k email addresses. The breach included extensive information about customers and payment histories including partial credit card numbers.
10. U

    Uiggy

    uiggy.com

    2.7Maccounts

    Breached 1 Jun 2016 Disclosed 27 Jun 2016

    Have I Been Pwned Verified

    • Email addresses
    • Genders
    • Names
    • Social connections
    • Website activity

    In June 2016, the Facebook application known as Uiggy was hacked and 4.3M accounts were exposed, 2.7M of which had email addresses against them. The leaked accounts also exposed names, genders and the Facebook ID of the owners.
11. V

    VK

    vk.com

    93.3Maccounts

    Breached 1 Jan 2012 Disclosed 9 Jun 2016

    Have I Been Pwned Verified

    • Email addresses
    • Names
    • Passwords
    • Phone numbers

    In approximately 2012, the Russian social media site known as VK was hacked and almost 100 million accounts were exposed. The data emerged in June 2016 where it was being sold via a dark market website and included names, phone numbers email addresses and plain text passwords.
12. B

    BitTorrent

    bittorrent.com

    34.2Kaccounts

    Breached 1 Jan 2016 Disclosed 8 Jun 2016

    Have I Been Pwned Verified

    • Email addresses
    • IP addresses
    • Passwords
    • Usernames

    In January 2016, the forum for the popular torrent software BitTorrent was hacked. The IP.Board based forum stored passwords as weak SHA1 salted hashes and the breached data also included usernames, email and IP addresses.
13. May 2016
14. M

    MySpace

    myspace.com

    359.4Maccounts

    Breached 1 Jul 2008 Disclosed 31 May 2016

    Have I Been Pwned Verified

    • Email addresses
    • Passwords
    • Usernames

    In approximately 2008, MySpace suffered a data breach that exposed almost 360 million accounts. In May 2016 the data was offered up for sale on the "Real Deal" dark market website and included email addresses, usernames and SHA1 hashes of the first 10 characters of the password converted to lowercase and stored without a salt. The exact breach date is unknown, but analysis of the data suggests it was 8 years before being made public.
15. T

    tumblr

    tumblr.com

    65.5Maccounts

    Breached 28 Feb 2013 Disclosed 30 May 2016

    Have I Been Pwned Verified

    • Email addresses
    • Passwords

    In early 2013, tumblr suffered a data breach which resulted in the exposure of over 65 million accounts. The data was later put up for sale on a dark market website and included email addresses and passwords stored as salted SHA1 hashes.
16. F

    Fling

    fling.com

    40.8Maccounts

    Breached 10 Mar 2011 Disclosed 29 May 2016

    Have I Been Pwned Verified Sensitive

    • Dates of birth
    • Email addresses
    • Genders
    • Geographic locations
    • IP addresses
    • Passwords
    • Phone numbers
    • +4 more

    In 2011, the self-proclaimed "World's Best Adult Social Network" website known as Fling was hacked and more than 40 million accounts obtained by the attacker. The breached data included highly sensitive personal attributes such as sexual orientation and sexual interests as well as email addresses and passwords stored in plain text.
17. F

    Fur Affinity

    furaffinity.net

    1.3Maccounts

    Breached 17 May 2016 Disclosed 27 May 2016

    Have I Been Pwned Verified Sensitive

    • Email addresses
    • Passwords
    • Usernames

    In May 2016, the Fur Affinity website for people with an interest in anthropomorphic animal characters (also known as "furries") was hacked. The attack exposed 1.2M email addresses (many accounts had a different "first" and "last" email against them) and hashed passwords.
18. L

    LinkedIn

    linkedin.com

    164.6Maccounts

    Breached 5 May 2012 Disclosed 21 May 2016

    Have I Been Pwned Verified

    • Email addresses
    • Passwords

    In May 2016, LinkedIn had 164 million email addresses and passwords exposed. Originally hacked in 2012, the data remained out of sight until being offered for sale on a dark market site 4 years later. The passwords in the breach were stored as SHA1 hashes without salt, the vast majority of which were quickly cracked in the days following the release of the data.
19. R

    Rosebutt Board

    rosebuttboard.com

    107.3Kaccounts

    Breached 9 May 2016 Disclosed 10 May 2016

    Have I Been Pwned Verified Sensitive

    • Email addresses
    • IP addresses
    • Passwords
    • Usernames

    Some time prior to May 2016, the forum known as "Rosebutt Board" was hacked and 107k accounts were exposed. The self-described "top one board for anal fisting, prolapse, huge insertions and rosebutt fans" had email and IP addresses, usernames and weakly stored salted MD5 password hashes hacked from the IP.Board based forum.
20. N

    Nulled.cr

    nulled.cr

    599.1Kaccounts

    Breached 6 May 2016 Disclosed 9 May 2016

    Have I Been Pwned Verified

    • Dates of birth
    • Email addresses
    • IP addresses
    • Passwords
    • Private messages
    • Usernames
    • Website activity

    In May 2016, the cracking community forum known as Nulled.cr was hacked and 599k user accounts were leaked publicly. The compromised data included email and IP addresses, weak salted MD5 password hashes and hundreds of thousands of private messages between members.
21. Q

    Qatar National Bank

    qnb.com

    88.7Kaccounts

    Breached 1 Jul 2015 Disclosed 1 May 2016

    Have I Been Pwned Verified

    • Bank account numbers
    • Customer feedback
    • Dates of birth
    • Financial transactions
    • Genders
    • Geographic locations
    • Government issued IDs
    • +9 more

    In July 2015, the Qatar National Bank suffered a data breach which exposed 15k documents totalling 1.4GB and detailing more than 100k accounts with passwords and PINs. The incident was made public some 9 months later in April 2016 when the documents appeared publicly on a file sharing site. Analysis of the breached data suggests the attack began by exploiting a SQL injection flaw in the bank's website.
22. April 2016
23. L

    Lifeboat

    lbsg.net

    7.1Maccounts

    Breached 1 Jan 2016 Disclosed 25 Apr 2016

    Have I Been Pwned Verified

    • Email addresses
    • Passwords
    • Usernames

    In January 2016, the Minecraft community known as Lifeboat was hacked and more than 7 million accounts leaked. Lifeboat knew of the incident for three months before the breach was made public but elected not to advise customers. The leaked data included usernames, email addresses and passwords stored as straight MD5 hashes.
24. B

    Beautiful People

    beautifulpeople.com

    1.1Maccounts

    Breached 11 Nov 2015 Disclosed 25 Apr 2016

    Have I Been Pwned Verified Sensitive

    • Beauty ratings
    • Car ownership statuses
    • Dates of birth
    • Drinking habits
    • Education levels
    • Email addresses
    • Genders
    • +13 more

    In November 2015, the dating website Beautiful People was hacked and over 1.1M accounts were leaked. The data was being traded in underground circles and included a huge amount of personal information related to dating.
25. T

    TruckersMP

    truckersmp.com

    84Kaccounts

    Breached 25 Feb 2016 Disclosed 24 Apr 2016

    Have I Been Pwned Verified

    • Email addresses
    • Passwords
    • Usernames

    In February 2016, the online trucking simulator mod TruckersMP suffered a data breach which exposed 84k user accounts. In a first for "Have I Been Pwned", the breached data was self-submitted directly by the organisation that was breached itself.
26. N

    Naughty America

    naughtyamerica.com

    1.4Maccounts

    Breached 14 Mar 2016 Disclosed 24 Apr 2016

    Have I Been Pwned Verified Sensitive

    • Dates of birth
    • Email addresses
    • IP addresses
    • Passwords
    • Usernames
    • Website activity

    In March 2016, the adult website Naughty America was hacked and the data consequently sold online. The breach included data from numerous systems with various personal identity attributes, the largest of which had passwords stored as easily crackable MD5 hashes. There were 1.4 million unique email addresses in the breach.
27. M

    Mate1.com

    mate1.com

    27.4Maccounts

    Breached 29 Feb 2016 Disclosed 15 Apr 2016

    Have I Been Pwned Verified Sensitive

    • Astrological signs
    • Dates of birth
    • Drinking habits
    • Drug habits
    • Education levels
    • Email addresses
    • Ethnicities
    • +18 more

    In February 2016, the dating site mate1.com suffered a huge data breach resulting in the disclosure of over 27 million subscribers' information. The data included deeply personal information about their private lives including drug and alcohol habits, incomes levels and sexual fetishes as well as passwords stored in plain text.
28. C

    COMELEC (Philippines Voters)

    comelec.gov.ph

    228.6Kaccounts

    Breached 27 Mar 2016 Disclosed 14 Apr 2016

    Have I Been Pwned Verified

    • Biometric data
    • Dates of birth
    • Email addresses
    • Family members' names
    • Genders
    • Job titles
    • Marital statuses
    • +5 more

    In March 2016, the Philippines Commission of Elections website (COMELEC) was attacked and defaced, allegedly by Anonymous Philippines. Shortly after, data on 55 million Filipino voters was leaked publicly and included sensitive information such as genders, marital statuses, height and weight and biometric fingerprint data. The breach only included 228k email addresses.

Breach records: Have I Been Pwned (CC BY 4.0), the HHS OCR breach portal, the Washington State Attorney General and the California Attorney General breach registers (public records). Last synced 15 hours ago.