Official Breach Notices
Not the claims of gangs: data breaches disclosed by organisations, regulators and verified records.
Get Revenge On Your Ex
In September 2022, the revenge website Get Revenge On Your Ex suffered a data breach that exposed almost 80k unique email addresses. The data spanned both customers and victims including names, IP and physical addresses, phone numbers, purchase histories and plain text passwords. The data was subsequently shared on a public hacking forum, Get Revenge On Your Ex did not reply when contacted.
GGCorp
In August 2022, the MMORPG website GGCorp suffered a data breach that exposed almost 2.4M unique email addresses . The data also included IP addresses, usernames and MD5 password hashes.
Lolzteam
In May 2018, the Russian hacking forum Lolzteam suffered a data breach that exposed 400k members . The impacted data included usernames and email addresses which were later redistributed via another hacking forum.
Doomworld
In October 2022, the Doomworld fourm suffered a data breach that exposed 34k member records. The data included email and IP addresses, usernames and bcrypt password hashes.
E-Pal
In October 2022, the service dedicated to finding friends on Discord known as E-Pal disclosed a data breach . The compromised data included over 100k unique email addresses and usernames spanning approximately 1M orders. The data was subsequently distributed via a popular hacking forum.
Wakanim
In August 2022, the European streaming service Wakanim suffered a data breach which was subsequently advertised and sold on a popular hacking forum . The breach exposed 6.7M customer records including email, IP and physical addresses, names and usernames.
Bhinneka
In early 2020, the Indonesian consumer electronics website Bhinneka suffered a data breach that exposed almost 1.3M customer records . The data included email and physical addresses, names, genders, dates of birth, phone numbers and salted password hashes.
TAP Air Portugal
In August 2022, the Portuguese airline TAP Air Portugal was the target of a ransomware attack perpetrated by the Ragnar Locker gang who later leaked the compromised data via a public dark web site. Over 5M unique email addresses were exposed alongside other personal data including names, genders, DoBs, phone numbers and physical addresses.
Brand New Tube
In August 2022, the streaming website Brand New Tube suffered a data breach that exposed the personal information of almost 350k subscribers . The impacted data included email and IP addresses, usernames, genders, passwords stored as unsalted SHA-1 hashes and private messages.
Stripchat
In November 2021, the live sex cams and adult chat website Stripchat left several databases exposed and unsecured . In June the following year, over 10M Stripchat records appeared on a popular hacking forum. The exposed data included usernames, email addresses and IP addresses.
START
In August 2022, news broke of an attack against the Russian streaming service "START" . The incident led to the exposure of 44M records containing 7.4M unique email addresses. The impacted data also included the subscriber's country and password hash. START subsequently acknowledged the incident in a Telegram post and stated that the data dated back to 2021.
Banorte
In August 2022, millions of records from Mexican bank "Banorte" were publicly dumped on a popular hacking forum including 2.1M unique email addresses, physical addresses, names, phone numbers, RFC (tax) numbers, genders and bank balances. Banorte have stated that the data is "outdated", although have not yet indicated how far back it dates to. Anecdotal feedback from HIBP subscribers suggests the data may date back 8 years to 2014.
SitePoint
In June 2020, the web development site SitePoint suffered a data breach that exposed over 1M customer records . Impacted data included email and IP addresses, names, usernames, bios and passwords stored as bcrypt hashes.
Shitexpress
In August 2022, the online faeces delivery service Shitexpress suffered a data breach that exposed 24k unique email addresses . The addresses spanned invoices, gift cards, promotions and PayPal records. The breach also exposed the IP and email addresses of senders, physical addresses of recipients and messages accompanying the shit delivery.
In January 2022, a vulnerability in Twitter's platform allowed an attacker to build a database of the email addresses and phone numbers of millions of users of the social platform . In a disclosure notice later shared in August 2022, Twitter advised that the vulnerability was related to a bug introduced in June 2021 and that they are directly notifying impacted customers. The impacted data included either email address or phone number alongside other public information including the username, display name, bio, location and profile photo. The data included 6.7M unique email addresses across both active and suspended accounts, the latter appearing in a separate list of 1.4M addresses.
QuestionPro
In May 2022, the survey website QuestionPro was the target of an extortion attempt relating to an alleged data breach . Over 100GB of data containing 22M unique email addresses (some of which appear to be generated by the platform), are alleged to have been extracted from the service along with IP addresses, browser user agents and results relating to surveys. QuestionPro would not confirm whether a breach had occurred (although they did confirm they were the target of an extortion attempt), so the data was initially flagged as "unverified". Subsequent verification by impacted HIBP subscribers later led to the removal of the unverified flag.
Tuned Global
In January 2021, data from a number of breached services including Tuned Global were released to a public hacking forum . The breach appears to date back to 2016 and includes 985k records containing email addresses, names, a small number of physical addresses and phone numbers and passwords stored in plain text.
Mecho Download
In October 2013, the (now defunct) downloads website "Mecho Download" suffered a data breach that exposed 438k records. Data from the vBulletin based website included email and IP addresses, usernames and passwords stored as salted MD5 hashes.
Battlefy
In January 2016, the esports website Battlefy suffered a data breach that exposed 83k customer records . The impacted data included email addresses, usernames and passwords stored as bcrypt hashes.
Shadi.com
In July 2016, the Muslim dating site Shadi.com suffered a data breach that exposed over 2M members' email addresses . The breach also exposed passwords stored as MD5 hashes alongside their plain text equivalents.
988 notices · page 21 / 50
Follow breach notices through the API
With a free API key you can take the same data into your dashboard, your scripts or your own application.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/breaches?source=kvkk"