Official Breach Notices
Not the claims of gangs: data breaches disclosed by organisations, regulators and verified records.
Mr. Green Gaming
In March 2024, the online games community Mr. Green Gaming suffered a data breach that exposed 27k user records. Acknowledged on their Discord server, the incident exposed email and IP addresses, usernames, geographic locations and dates of birth.
Federal Home Loan Bank of New York
Material cybersecurity incident disclosed to the U.S. Securities and Exchange Commission under Form 8-K Item 1.05.
Cutout.Pro
In February 2024, the AI-powered visual design platform Cutout.Pro suffered a data breach that exposed 20M records . The data included email and IP addresses, names and salted MD5 password hashes which were subsequently broadly distributed on a popular hacking forum and Telegram channels.
Tangerine
In February 2024, the Australian Telco Tangerine suffered a data breach that exposed over 200k customer records . Attributed to a legacy customer database, the data included physical and email addresses, names, phone numbers and dates of birth. Whilst the Tangerine login process involves sending a one-time password after entering an email address and phone number, it previously used a traditional password which was also exposed as a bcrypt hash.
Cencora, Inc.
Material cybersecurity incident disclosed to the U.S. Securities and Exchange Commission under Form 8-K Item 1.05.
Facebook Marketplace
In February 2024, 200k Facebook Marketplace records allegedly obtained from a Meta contractor in October 2023 were posted to a popular hacking forum . The data contained 77k unique email addresses alongside names, phone numbers, Facebook profile IDs and geographic locations. The data also contained bcrypt password hashes, although there is no indication these belong to the corresponding Facebook accounts.
UNITEDHEALTH GROUP INC
Material cybersecurity incident disclosed to the U.S. Securities and Exchange Commission under Form 8-K Item 1.05.
PRUDENTIAL FINANCIAL INC
Material cybersecurity incident disclosed to the U.S. Securities and Exchange Commission under Form 8-K Item 1.05.
PRUDENTIAL FINANCIAL INC
Material cybersecurity incident disclosed to the U.S. Securities and Exchange Commission under Form 8-K Item 1.05.
SouthState Corp
Material cybersecurity incident disclosed to the U.S. Securities and Exchange Commission under Form 8-K Item 1.05.
Spoutible
In January 2024, Spoutible had 207k records scraped from a misconfigured API that inadvertently returned excessive personal information . The data included names, usernames, email and IP addresses, phone numbers (where provided to the platform), genders and bcrypt password hashes. The incident also exposed 2FA secrets and backup codes along with password reset tokens.
MyPertamina
In November 2022, the Indonesian oil and gas company Pertamina suffered a data breach of their MyPertamina service . The incident exposed 44M records with 6M unique email addresses along with names, dates of birth, genders, physical addresses and purchases.
Hewlett Packard Enterprise Co
Material cybersecurity incident disclosed to the U.S. Securities and Exchange Commission under Form 8-K Item 1.05.
Trello
In January 2024, data was scraped from Trello and posted for sale on a popular hacking forum . Containing over 15M email addresses, names and usernames, the data was obtained by enumerating a publicly accessible resource using email addresses from previous breach corpuses. Trello advised that no unauthorised access had occurred.
MICROSOFT CORP
Material cybersecurity incident disclosed to the U.S. Securities and Exchange Commission under Form 8-K Item 1.05.
V F CORP
Material cybersecurity incident disclosed to the U.S. Securities and Exchange Commission under Form 8-K Item 1.05.
Naz.API
In September 2023, over 100GB of stealer logs and credential stuffing lists titled "Naz.API" was posted to a popular hacking forum . The incident contained a combination of email address and plain text password pairs alongside the service they were entered into, and standalone credential pairs obtained from unnamed sources. In total, the corpus of data included 71M unique email addresses and 100M unique passwords.
Hathway
In December 2023, hundreds of gigabytes of data allegedly taken from Indian ISP and digital TV provider Hathway appeared on a popular hacking website . The incident exposed extensive personal information including 4.7M unique email addresses along with names, physical and IP addresses, phone numbers, password hashes and support ticket logs.
First American Financial Corp
Material cybersecurity incident disclosed to the U.S. Securities and Exchange Commission under Form 8-K Item 1.05.
Legendas.TV
In October 2017, the now defunct Brazilian service for retrieving subtitles in Portuguese Legendas.TV suffered a data breach that exposed nearly 4M customer records . The impacted data included names, usernames, email and IP addresses and unsalted SHA-1 hashes.
1.186 notices · page 25 / 60
Follow breach notices through the API
With a free API key you can take the same data into your dashboard, your scripts or your own application.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/breaches?source=kvkk"