Official Breach Notices
Not the claims of gangs: data breaches disclosed by organisations, regulators and verified records.
Lookiero
In August 2024, a data breach from the online styling service Lookiero was posted to a popular hacking forum . Dating back to March 2024, the data included 5M unique email addresses, with many of the records also including name, phone number and physical address. When contacted about the incident, Lookiero advised that they would "look into it and get back to you if necessary".
Sport 2000
In April 2024, the French sporting equipment manufacturer Sport 2000 announced it had suffered a data breach . The data was subsequently put up for sale on a popular hacking forum and included 4.4M rows with 3.2M unique email addresses alongside names, physical addresses, phone numbers, dates of birth and purchases made by store name.
Traderie
In September 2022, the in-game trading marketplace Traderie suffered a data breach that exposed almost 400k records (this preceded a subsequent breach the following year). The incident exposed email and IP addresses, usernames and links to social media profiles.
Tracki
In August 2024, a slew of security vulnerabilities were identified with a conglomerate of online services which included the GPS tracking service Tracki . Multiple vulnerabilities exposed the personal records of 372k users of the service including names and email addresses.
Explore Talent (August 2024)
In August 2024, a slew of security vulnerabilities were identified with a conglomerate of online services which included the talent network Explore Talent . A vulnerable API exposed the personal records of 11.4M users of the service of which 8.9M unique email addresses were provided to HIBP. This incident is separate to the Explore Talent breach which occurred in 2022 and was loaded into HIBP in July 2024.
Chris Leong
In August 2024, the website of Master Chris Leong "a leading Tit Tar practitioner in Malaysia" suffered a data breach . The incident exposed 27k unique email addresses along with names, physical addresses, dates of birth, genders, nationalities and in many cases, links to Facebook profiles. The company did not respond when contacted about the breach.
LDLC
In March 2024, French retailer LDLC disclosed a data breach that impacted customers of their physical stores . The data was previously listed for sale on a popular hacking forum and contained 1.26M unique email addresses along with names, phone numbers and physical addresses.
Shadow
In September 2023, the cloud gaming provider Shadow suffered a data breach that exposed over half a million customer records . The data included email and physical addresses, names and dates of birth.
Not SOCRadar
In August 2024, over 332M rows of email addresses were posted to a popular hacking forum. The post alleged the addresses were scraped from cybersecurity firm SOCRadar, however an investigation on their behalf concluded that "the actor merely utilised functionalities inherent in the platform's standard offerings, designed to gather information from publicly available sources" . There is no suggestion the incident compromised SOCRadar's security or posed any risk to their customers. In total, the data set contained 282M unique addresses of valid email address format.
Shoe Zone
In June 2024, the UK footwear chain Shoe Zone disclosed a data breach that was subsequently posted for sale on a popular hacking forum . The data included over 100k orders containing names, addresses, partial credit card numbers (card type and last 4 digits), and 46k unique email addresses.
LuLu
In July 2024, the Emirati-based LuLu retail store suffered a data breach . The impacted data included 190k email addresses and associated phone numbers which were subsequently shared on a popular hacking forum. The following month, the threat of leaking the full database was carried out and a backup from October 2022 with a further 2.6M unique email addresses appeared. This data also included names, physical addresses, orders and PBKDF2 password hashes.
Multiplayer.it
In April 2024, over half a million records taken from the Italian gaming website Multiplayer.it were posted to a popular hacking forum . The impacted data included email addresses, usernames and salted MD5 password hashes. Multiplayer.it subsequently confirmed the breach dated back 6 years to September 2018 and was merely re-posted in 2024.
Stealer Logs Posted to Telegram
In July 2024, info stealer logs with 26M unique email addresses were collated from malicious Telegram channels . The data contained 22GB of logs consisting of email addresses, passwords and the websites they were used on, all obtained by malware running on infected machines.
AnimeLeague
In July 2024, AnimeLeague disclosed a data breach of their services . The data was posted for sale on a popular hacking forum and included 2 databases covering both event registration records and a dump of the phpBB bulletin board. The impacted data included passwords in various hashed formats including SHA-1, salted md5 and bcrypt, as well as usernames, private messages, dates of birth, purchases and 192k unique email addresses.
Ubook
In July 2024, 700k unique email addresses from the audiobook platform Ubook were posted to a popular hacking forum . Allegedly scraped from the service, the data appears to be sourced from the Ubook Exchange (UBX) and also includes names, genders, dates of birth and links to profile photos.
Spytech
In July 2024, spyware maker Spytech suffered a data breach that exposed data collected as recently as the previous month . Designed to "invisibly record everything users do", the breach exposed information related to both purchasers and targets of the product. Target data collection (and subsequent exposure) included the infected computer name, browsing history, applications used, usernames of authenticated users, keywords being monitored, file operations (creation and deletion), computer usage times and email addresses, often captured within the spyware's logs. The data also included the names, purchases and md5 password hashes of purchasers.
Condo.com
In June 2019, now defunct website Condo.com suffered a data breach that was later redistributed as part of a larger corpus of data . The impacted data included 1.5M email addresses alongside names, phone numbers and for a small number of records, physical addresses.
Explore Talent (July 2024)
In July 2024, a data breach attributed to Explore Talent was publicly posted to a popular hacking forum . Containing 5.7M rows with 5.4M unique email addresses, the incident has been described by various sources as occurring between early 2022 to 2023 and also contains names, phone numbers and physical addresses.
Life360
In July 2024, data scraped from a misconfigured Life360 API was posted online after being obtained several months earlier . The records included 443k unique email addresses and in most cases, corresponding names and phone numbers (some records were null or obfuscated). Life360 promptly notified impacted users after the incident was discovered.
mSpy (2024)
In June 2024, a huge trove of data from spyware maker mSpy was obtained by hacktivists and published online . Comprising of 142GB of user data and support tickets along with 176GB of more than half a million attachments, the data contained 2.4M unique email addresses, IP addresses names and photos. The data was predominantly support tickets seeking help to install the spyware on target devices, whilst the attachments contained various data including screen grans of financial transactions, photos of credit cards and nude selfies.
988 notices · page 13 / 50
Follow breach notices through the API
With a free API key you can take the same data into your dashboard, your scripts or your own application.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/breaches?source=kvkk"