Data Breaches

Check your email or password

Find out whether your email address or a password are leaked somewhere.

Check your email address or password…

  1. Cannabis.com

    cannabis.com
    227.7Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Geographic locations
    • Historical passwords
    • Instant messenger identities
    • IP addresses
    • Passwords
    • +3 more
    In February 2014, the vBulletin forum for the Marijuana site cannabis.com was breached and leaked publicly. Whilst there has been no public attribution of the breach, the leaked data included over 227k accounts and nearly 10k private messages between users of the forum.

  2. hackforums.net

    hackforums.net
    191.5Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Instant messenger identities
    • IP addresses
    • Passwords
    • Social connections
    • Spoken languages
    • +4 more
    In June 2011, the hacktivist group known as "LulzSec" leaked one final large data breach they titled "50 days of lulz". The compromised data came from sources such as AT&T, Battlefield Heroes and the hackforums.net website. The leaked Hack Forums data included credentials and personal information of nearly 200,000 registered forum users.

  3. Business Acumen Magazine

    businessacumen.biz
    26.6Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    • Usernames
    • Website activity
    In April 2014, the Australian "Business Acumen Magazine" website was hacked by an attacker known as 1337MiR. The breach resulted in over 26,000 accounts being exposed including usernames, email addresses and password stored with a weak cryptographic hashing algorithm (MD5 with no salt).

  4. Fridae

    fridae.asia
    35.4Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified Sensitive
    • Email addresses
    • Passwords
    • Usernames
    • Website activity
    In May 2014, over 25,000 user accounts were breached from the Asian lesbian, gay, bisexual and transgender website known as "Fridae". The attack which was announced on Twitter appears to have been orchestrated by Deletesec who claim that "Digital weapons shall annihilate all secrecy within governments and corporations". The exposed data included password stored in plain text.

  5. BigMoneyJobs

    bigmoneyjobs.com
    36.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Career levels
    • Education levels
    • Email addresses
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    • +3 more
    In April 2014, the job site bigmoneyjobs.com was hacked by an attacker known as "ProbablyOnion". The attack resulted in the exposure of over 36,000 user accounts including email addresses, usernames and passwords which were stored in plain text. The attack was allegedly mounted by exploiting a SQL injection vulnerability.

  6. Boxee

    forums.boxee.com
    158.1Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Geographic locations
    • Historical passwords
    • Instant messenger identities
    • IP addresses
    • Passwords
    • +3 more
    In March 2014, the home theatre PC software maker Boxee had their forums compromised in an attack. The attackers obtained the entire vBulletin MySQL database and promptly posted it for download on the Boxee forum itself. The data included 160k users, password histories, private messages and a variety of other data exposed across nearly 200 publicly exposed tables.

  7. hemmelig.com

    hemmelig.com
    28.6Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified Sensitive
    • Email addresses
    • Genders
    • Nicknames
    • Partial dates of birth
    • Passwords
    • Usernames
    In December 2011, Norway's largest online sex shop hemmelig.com was hacked by a collective calling themselves "Team Appunity". The attack exposed over 28,000 usernames and email addresses along with nicknames, gender, year of birth and unsalted MD5 password hashes.

  8. UN Internet Governance Forum

    intgovforum.org
    3.2Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Names
    • Passwords
    • Usernames
    In February 2014, the Internet Governance Forum (formed by the United Nations for policy dialogue on issues of internet governance) was attacked by hacker collective known as Deletesec. Although tasked with "ensuring the security and stability of the Internet", the IGF’s website was still breached and resulted in the leak of 3,200 email addresses, names, usernames and cryptographically stored passwords.

  9. Muslim Directory

    muslimdirectory.co.uk
    37.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Age groups
    • Email addresses
    • Employers
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    • +1 more
    In February 2014, the UK guide to services and business known as the Muslim Directory was attacked by the hacker known as @th3inf1d3l. The data was consequently dumped publicly and included the web accounts of tens of thousands of users which contained data including their names, home address, age group, email, website activity and password in plain text.

  10. Spirol

    spirol.com
    55.6Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Employers
    • Job titles
    • Names
    • Phone numbers
    • Physical addresses
    In February 2014, Connecticut based Spirol Fastening Solutions suffered a data breach that exposed over 70,000 customer records. The attack was allegedly mounted by exploiting a SQL injection vulnerability which yielded data from Spirol’s CRM system ranging from customers’ names, companies, contact information and over 55,000 unique email addresses.

  11. Forbes

    forbes.com
    1.1Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • User website URLs
    • Usernames
    In February 2014, the Forbes website succumbed to an attack that leaked over 1 million user accounts. The attack was attributed to the Syrian Electronic Army, allegedly as retribution for a perceived "Hate of Syria". The attack not only leaked user credentials, but also resulted in the posting of fake news stories to forbes.com.

  13. Bell (2014 breach)

    bell.ca
    20.9Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Credit cards
    • Genders
    • Passwords
    • Usernames
    In February 2014, Bell Canada suffered a data breach via the hacker collective known as NullCrew. The breach included data from multiple locations within Bell and exposed email addresses, usernames, user preferences and a number of unencrypted passwords and credit card data from 40,000 records containing just over 20,000 unique email addresses and usernames.

  14. WPT Amateur Poker League

    wptapl.com
    148.4Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    In January 2014, the World Poker Tour (WPT) Amateur Poker League website was hacked by the Twitter user @smitt3nz. The attack resulted in the public disclosure of 175,000 accounts including 148,000 email addresses. The plain text password for each account was also included in the breach.

  16. Snapchat

    snapchat.com
    4.6Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Geographic locations
    • Phone numbers
    • Usernames
    In January 2014 just one week after Gibson Security detailed vulnerabilities in the service, Snapchat had 4.6 million usernames and phone number exposed. The attack involved brute force enumeration of a large number of phone numbers against the Snapchat API in what appears to be a response to Snapchat's assertion that such an attack was "theoretical". Consequently, the breach enabled individual usernames (which are often used across other services) to be resolved to phone numbers which users usually wish to keep private.

  17. Pixel Federation

    pixelfederation.com
    38.1Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    In December 2013, a breach of the web-based game community based in Slovakia exposed over 38,000 accounts which were promptly posted online. The breach included email addresses and unsalted MD5 hashed passwords, many of which were easily converted back to plain text.

  18. Yahoo

    yahoo.com
    453.4Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    In July 2012, Yahoo! had their online publishing service "Voices" compromised via a SQL injection attack. The breach resulted in the disclosure of nearly half a million usernames and passwords stored in plain text. The breach showed that of the compromised accounts, a staggering 59% of people who also had accounts in the Sony breach reused their passwords across both services.

  19. Stratfor

    stratfor.com
    859.8Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Credit cards
    • Email addresses
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    • Usernames
    In December 2011, "Anonymous" attacked the global intelligence company known as "Stratfor" and consequently disclosed a veritable treasure trove of data including hundreds of gigabytes of email and tens of thousands of credit card details which were promptly used by the attackers to make charitable donations (among other uses). The breach also included 860,000 user accounts complete with email address, time zone, some internal system data and MD5 hashed passwords with no salt.

  20. Sony

    sony.com
    37.1Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Dates of birth
    • Email addresses
    • Genders
    • Names
    • Passwords
    • Phone numbers
    • Physical addresses
    • +1 more
    In 2011, Sony suffered breach after breach after breach — it was a very bad year for them. The breaches spanned various areas of the business ranging from the PlayStation network all the way through to the motion picture arm, Sony Pictures. A SQL Injection vulnerability in sonypictures.com lead to tens of thousands of accounts across multiple systems being exposed complete with plain text passwords.

  21. Gawker

    gawker.com
    1.2Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Passwords
    • Usernames
    In December 2010, Gawker was attacked by the hacker collective "Gnosis" in retaliation for what was reported to be a feud between Gawker and 4Chan. Information about Gawkers 1.3M users was published along with the data from Gawker's other web presences including Gizmodo and Lifehacker. Due to the prevalence of password reuse, many victims of the breach then had their Twitter accounts compromised to send Acai berry spam.

  22. Adobe

    adobe.com
    152.4Maccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Email addresses
    • Password hints
    • Passwords
    • Usernames
    In October 2013, 153 million Adobe accounts were breached with each containing an internal ID, username, email, encrypted password and a password hint in plain text. The password cryptography was poorly done and many were quickly resolved back to plain text. The unencrypted hints also disclosed much about the passwords adding further to the risk that hundreds of millions of Adobe customers already faced.

  23. Vodafone

    vodafone.is
    56Kaccounts
    Breached Disclosed
    Have I Been Pwned Verified
    • Credit cards
    • Email addresses
    • Government issued IDs
    • IP addresses
    • Names
    • Passwords
    • Phone numbers
    • +4 more
    In November 2013, Vodafone in Iceland suffered an attack attributed to the Turkish hacker collective "Maxn3y". The data was consequently publicly exposed and included user names, email addresses, social security numbers, SMS message, server logs and passwords from a variety of different internal sources.

Breach records: Have I Been Pwned (CC BY 4.0), the HHS OCR breach portal, the Washington State Attorney General and the California Attorney General breach registers (public records). Last synced 12 hours ago.