Official Breach Notices
Not the claims of gangs: data breaches disclosed by organisations, regulators and verified records.
Ubook
In July 2024, 700k unique email addresses from the audiobook platform Ubook were posted to a popular hacking forum . Allegedly scraped from the service, the data appears to be sourced from the Ubook Exchange (UBX) and also includes names, genders, dates of birth and links to profile photos.
Spytech
In July 2024, spyware maker Spytech suffered a data breach that exposed data collected as recently as the previous month . Designed to "invisibly record everything users do", the breach exposed information related to both purchasers and targets of the product. Target data collection (and subsequent exposure) included the infected computer name, browsing history, applications used, usernames of authenticated users, keywords being monitored, file operations (creation and deletion), computer usage times and email addresses, often captured within the spyware's logs. The data also included the names, purchases and md5 password hashes of purchasers.
Condo.com
In June 2019, now defunct website Condo.com suffered a data breach that was later redistributed as part of a larger corpus of data . The impacted data included 1.5M email addresses alongside names, phone numbers and for a small number of records, physical addresses.
Explore Talent (July 2024)
In July 2024, a data breach attributed to Explore Talent was publicly posted to a popular hacking forum . Containing 5.7M rows with 5.4M unique email addresses, the incident has been described by various sources as occurring between early 2022 to 2023 and also contains names, phone numbers and physical addresses.
Crimson Wine Group, Ltd
Material cybersecurity incident disclosed to the U.S. Securities and Exchange Commission under Form 8-K Item 1.05.
Life360
In July 2024, data scraped from a misconfigured Life360 API was posted online after being obtained several months earlier . The records included 443k unique email addresses and in most cases, corresponding names and phone numbers (some records were null or obfuscated). Life360 promptly notified impacted users after the incident was discovered.
BASSETT FURNITURE INDUSTRIES INC
Material cybersecurity incident disclosed to the U.S. Securities and Exchange Commission under Form 8-K Item 1.05.
AT&T INC.
Material cybersecurity incident disclosed to the U.S. Securities and Exchange Commission under Form 8-K Item 1.05.
mSpy (2024)
In June 2024, a huge trove of data from spyware maker mSpy was obtained by hacktivists and published online . Comprising of 142GB of user data and support tickets along with 176GB of more than half a million attachments, the data contained 2.4M unique email addresses, IP addresses names and photos. The data was predominantly support tickets seeking help to install the spyware on target devices, whilst the attachments contained various data including screen grans of financial transactions, photos of credit cards and nude selfies.
The Heritage Foundation
In July 2024, hacktivists published almost 2GB of data taken from The Heritage Foundation and their media arm, The Daily Signal . The data contained 72k unique email addresses, primarily used for commenting on articles (along with names, IP addresses and the comments left) and by content contributors (along with usernames and passwords stored as either MD5 or phpass hashes).
Neiman Marcus
In May 2024, the American luxury retailer Neiman Marcus suffered a data breach which was later posted to a popular hacking forum . The data included 31M unique email addresses, names, phone numbers, dates of birth, physical addresses and partial credit card data (note: this is insufficient to make purchases). The breach was traced back to a series of attacks against the Snowflake cloud service which impacted 165 organisations worldwide.
Husky Owners
In July 2024, the Husky Owners forum website was defaced and linked to a breach of user data containing 16k records. The exposed data included usernames, email addresses, dates of birth and time zones.
FNTECH
In July 2024, the events management platform FNTECH suffered a data breach that exposed 10k unique email addresses. The data contained registrants from various events, including participants of the Roblox Developer Conference registration list . The data also included names and IP addresses.
SONIC AUTOMOTIVE INC
Material cybersecurity incident disclosed to the U.S. Securities and Exchange Commission under Form 8-K Item 1.05.
Date Hot Brunettes
In January 2021, the now defunct website Date Hot Brunettes which provided a service to "Date Neglected Women Who Can Keep a Secret", suffered a data breach. The incident exposed 1.5M unique email addresses along with IP addresses, usernames, user-entered bios and MD5 password hashes.
Ticketek
In May 2024, the Australian event ticketing company Ticketek reported a data breach linked to a third party cloud-based platform . The following month, the data appeared for sale on a popular hacking forum and was later linked to a series of breaches of the Snowflake cloud storage service. The data contained almost 30M rows with 17.6M unique email addresses alongside names, genders, dates of birth and hashed passwords.
Advance Auto Parts
In June 2024, Advance Auto Parts confirmed they had suffered a data breach which was posted for sale to a popular hacking forum. Linked to unauthorised access to Snowflake cloud services, the breach exposed a large number of records related to both customers and employees. In total, 79M unique email addresses were included in the breach, alongside names, phone numbers, addresses and further data attributes related to company employees.
Zadig & Voltaire
In June 2024, a data brach sourced from French fashion brand Zadig & Voltaire was publicly posted to a popular hacking forum . The data included names, email and physical addresses, phone numbers and genders. When contacted about the incident, Zadig & Voltaire advised the incident had occurred more than 6 months ago and that "all measures were taken quickly".
KEY TRONIC CORP
Material cybersecurity incident disclosed to the U.S. Securities and Exchange Commission under Form 8-K Item 1.05.
Combolists Posted to Telegram
In May 2024, 2B rows of data with 361M unique email addresses were collated from malicious Telegram channels . The data contained 122GB across 1.7k files with email addresses, usernames, passwords and in many cases, the website they were entered into. The data appears to have been sourced from a combination of existing combolists and info stealer malware.
1.186 notices · page 22 / 60
Follow breach notices through the API
With a free API key you can take the same data into your dashboard, your scripts or your own application.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/breaches?source=kvkk"