Official Breach Notices
Not the claims of gangs: data breaches disclosed by organisations, regulators and verified records.
GunAuction.com
In December 2022, the online firearms auction website GunAuction.com suffered a data breach which was later discovered left unprotected on the hacker's server . The data included over 565k user records with extensive personal data including email, IP and physical addresses, names, phone numbers, genders, years of birth, credit card type and passwords stored in plain text. The leaked identities could subsequently be matched to firearms listed for sale on the website.
Convex
In February 2023, the Russian telecommunications provider Convex was hacked by "Anonymous" who subsequently released 128GB of data publicly , alleging it revealed illegal government surveillance. The leaked data contained 150k unique email, IP and physical addresses, names and phone numbers.
RealDudesInc
In October 2022, the GTA mod menu provider RealDudesInc suffered a data breach that exposed over 100k email addresses (many of which are temporary guest account addresses). The breach also included usernames and bcrypt password hashes.
Weee
In February 2023, data belonging to the Asian and Hispanic food delivery service Weee appeared on a popular hacking forum . Dating back to mid-2022, the data included 1.1M unique email addresses from 11M rows of orders containing names, phone numbers and delivery instructions.
LimeVPN
In October 2020, the VPN provider LimeVPN suffered a data breach that exposed the personal information of tens of thousands of customers . The data included email, IP and physical addresses, names, phone numbers, purchase histories and passwords stored as salted MD5 hashes.
Truth Finder
In 2019, the public records search service TruthFinder suffered a data breach that later came to light in early 2023 . The data included over 8M unique customer email addresses, names, phone numbers and passwords stored as scrypt hashes.
Instant Checkmate
In 2019, the public records search service Instant Checkmate suffered a data breach that later came to light in early 2023 . The data included almost 12M unique customer email addresses, names, phone numbers and passwords stored as scrypt hashes.
School District 42
In January 2023, Pitt Meadows School District 42 in British Columbia suffered a data breach . The incident exposed the names and email addresses of approximately 19k students and staff which were consequently redistributed on a popular hacking forum.
Planet Ice
In January 2023, the UK-based ice skating rink booking service Planet Ice suffered a data breach . The incident exposed the personal data of 240k people including email and physical addresses, phone numbers, genders, dates of birth and passwords stored as MD5 hashes. The data also included the names, genders and dates of birth of children having parties.
KomplettFritid
In January 2023, the online Norwegian store KomplettFritid was reported as having had a data breach dating back to February 2021 . The incident exposed 140k customer records including physical, email and IP addresses, names, phone numbers and passwords. Most passwords were stored as bcrypt hashes with a small number appearing in plain text.
Autotrader
In January 2023, 1.4M records from the Autotrader online vehicle marketplace appeared on a popular hacking forum . Autotrader stated that the "data in question relates to aged listing data that was generally publicly available on our site at the time and open to automated collection methods". The data contained 20k unique email addresses alongside physical addresses and phone numbers of dealers and vehicle details including VIN numbers.
Zurich
In January 2023, the Japanese arm of Zurich insurance suffered a data breach that exposed 2.6M customer records with over 756k unique email addresses . The data was subsequently posted to a popular hacking forum and also included names, genders, dates of birth and details of insured vehicles.
DoorDash
In August 2022, the food ordering and delivery service DoorDash disclosed a data breach that impacted a portion of their customers . DoorDash attributed the breach to an unnamed "third-party vendor" they stated was the victim of a phishing campaign. The incident exposed 367k unique personal email addresses alongside names, post codes and partial card data, namely the brand, expiry data and last four digits of the card.
SlideTeam
In April 2021, the "world’s largest collection of pre-designed presentation slides" SlideTeam had 1.4M records breached and later published to a popular hacking forum the following year . Allegedly sourced from a compromised Magento instance, the data included names, email addresses and passwords stored as salted hashes.
Twitter (200M)
In early 2023, over 200M records scraped from Twitter appeared on a popular hacking forum . The data was obtained sometime in 2021 by abusing an API that enabled email addresses to be resolved to Twitter profiles. The subsequent results were then composed into a corpus of data containing email addresses alongside public Twitter profile information including names, usernames and follower counts.
Deezer
In late 2022, the music streaming service Deezer disclosed a data breach that impacted over 240M customers . The breach dated back to a mid-2019 backup exposed by a 3rd party partner which was subsequently sold and then broadly redistributed on a popular hacking forum. Impacted data included 229M unique email addresses, IP addresses, names, usernames, genders, DoBs and the geographic location of the customer.
Benchmark
In November 2019, the Serbian technology news website Benchmark suffered a breach of its forum that exposed 93k customer records. The breach exposed IP and email addresses, usernames and passwords stored as salted MD5 hashes. A forum administrator subsequently advised that the breach was due to the forum previously running on an outdated vBulletin instance .
Gemini
In late 2022, a hacker posted a data set to a public hacking forum which they alleged was sourced from the Gemini crypto exchange , a claim that was later proven to be false as the data was traced back to an incident at a third-party vendor . The source of the breach was later established as being Twilio, who processed the data of some Gemini customers using their Authy service for 2FA. Twilio described the incident as stemming from a sophisticated social engineering attack designed to steal employee credentials .
CoinTracker
In December 2022, the Crypto & NFT taxes service CoinTracker reported a data breach that impacted over 1.5M of their customers . The company later attributed the breach to a compromise SendGrid in an attack that targeted multiple customers of the email provider. The breach exposed email addresses and partially redacted phone numbers, with CoinTracker advising that the later did not originate from their service.
Abandonia (2022)
In November 2022, the gaming website dedicated to classic DOS games Abandonia suffered a data breach resulting in the exposure of 920k unique user records. This breach was in addition to another one 7 years earlier in 2015. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords.
988 notices · page 20 / 50
Follow breach notices through the API
With a free API key you can take the same data into your dashboard, your scripts or your own application.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/breaches?source=kvkk"