Official Breach Notices
Not the claims of gangs: data breaches disclosed by organisations, regulators and verified records.
CashCrate
In June 2017, news broke that CashCrate had suffered a data breach exposing 6.8 million records . The breach of the cash-for-surveys site dated back to November 2016 and exposed names, physical addresses, email addresses and passwords stored in plain text for older accounts along with weak MD5 hashes for newer ones.
Taringa
In September 2017, news broke that Taringa had suffered a data breach exposing 28 million records . Known as "The Latin American Reddit", Taringa's breach disclosure notice indicated the incident dated back to August that year. The exposed data included usernames, email addresses and weak MD5 hashes of passwords.
Smogon
In April 2018, the Pokémon website known as Smogon announced they'd suffered a data breach . The breach dated back to September 2017 and affected their XenForo based forum. The exposed data included usernames, email addresses, genders and both bcrypt and MD5 password hashes.
Bestialitysextaboo
In March 2018, the animal bestiality website known as Bestialitysextaboo was hacked . A collection of various sites running on the same service were also compromised and details of the hack (including links to the data) were posted on a popular forum. In all, more than 3.2k unique email addresses were included alongside usernames, IP addresses, dates of birth, genders and bcrypt hashes of passwords.
MDPI
In August 2016, the Swiss scholarly open access publisher known as MDPI had 17.5GB of data obtained from an unprotected Mongo DB instance. The data contained email exchanges between MDPI and their authors and reviewers which included 845k unique email addresses. MDPI have confirmed that the system has since been protected and that no data of a sensitive nature was impacted. As such, they concluded that notification to their subscribers was not necessary due to the fact that all their authors and reviewers are available online on their website.
Florida Virtual School
In March 2018, the Florida Virtual School (FLVS) posted a data breach notification to their website . The school had identified a data breach which had occurred sometime between 6 May 2016 and 12 Feb 2018 and an XML file containing 368k student records was subsequently found circulating. Each record contained student name, date of birth, password, grade, email and parent email resulting in a total of 543k unique email addresses. Due to the prevalence of email addresses belonging to individuals who are still legally children, the data breach has been flagged as "sensitive".
MangaFox.me
In approximately July 2016, the manga website known as mangafox.me suffered a data breach. The vBulletin based forum exposed 1.3 million accounts including usernames, email and IP addresses, dates of birth and salted MD5 password hashes.
xHamster
In November 2016, news broke that hackers were trading hundreds of thousands of xHamster porn account details . In total, the data contained almost 380k unique user records including email addresses, usernames and unsalted MD5 password hashes.
Underworld Empire
In April 2017, the vBulletin forum for the Underworld Empire game suffered a data breach that exposed 429k accounts. The data was then posted to a hacking forum in mid-February 2018 where it was made available to download. The source data contained IP and email addresses, usernames and salted MD5 hashes.
8tracks
In June 2017, the online playlists service known as 8Tracks suffered a data breach which impacted 18 million accounts. In their disclosure, 8Tracks advised that "the vector for the attack was an employee’s GitHub account, which was not secured using two-factor authentication". Salted SHA-1 password hashes for users who didn't sign up with either Google or Facebook authentication were also included. The data was provided to HIBP by whitehat security researcher and data analyst Adam Davies and contained almost 8 million unique email addresses. The complete set of 18M records was later provided by JimScott.Sec@protonmail.com and updated in HIBP accordingly.
Guns and Robots
In approximately April 2016, the gaming website Guns and Robots suffered a data breach resulting in the exposure of 143k unique records. The data contained email and IP addresses, usernames and SHA-1 password hashes. The site was previously reported as compromised on the Vigilante.pw breached database directory.
Autocentrum.pl
In February 2018, data belonging to the Polish motoring website autocentrum.pl was found online . The data contained 144k email addresses and plain text passwords.
TheTVDB.com
In November 2017, the open television database known as TheTVDB.com suffered a data breach . The breached data was posted to a hacking forum and included 182k records with usernames, email addresses and MySQL password hashes.
The Fly on the Wall
In December 2017, the stock market news website The Fly on the Wall suffered a data breach. The data in the breach included 84k unique email addresses as well as purchase histories and credit card data. Numerous attempts were made to contact The Fly on the Wall about the incident , however no responses were received.
Lyrics Mania
In December 2017, the song lyrics website known as Lyrics Mania suffered a data breach. The data in the breach included 109k usernames, email addresses and plain text passwords. Numerous attempts were made to contact Lyrics Mania about the incident , however no responses were received.
Open CS:GO
In December 2017, the website for purchasing Counter-Strike skins known as Open CS:GO (Counter-Strike: Global Offensive) suffered a data breach (address since redirects to dropgun.com). The 10GB file contained an extensive amount of personal information including email and IP addresses, phone numbers, physical addresses and purchase histories. Numerous attempts were made to contact Open CS:GO about the incident , however no responses were received.
2fast4u
In December 2017, the Belgian motorcycle forum 2fast4u discovered a data breach of their system. The breach of the vBulletin message board impacted over 17k individual users and exposed email addresses, usersnames and salted MD5 passwords.
HoundDawgs
In December 2017, the Danish torrent tracker known as HoundDawgs suffered a data breach . More than 55GB of data was dumped publicly and whilst there was initially contention as to the severity of the incident , the data did indeed contain more than 45k unique email addresses complete extensive logs of torrenting activity, IP addresses and SHA1 passwords.
Ancestry
In November 2015, an Ancestry service known as RootsWeb suffered a data breach . The breach was not discovered until late 2017 when a file containing almost 300k email addresses and plain text passwords was identified.
CrackingForum
In approximately mid-2016, the cracking community forum known as CrackingForum suffered a data breach. The vBulletin based forum exposed 660k email and IP addresses, usernames and salted MD5 hashes.
988 notices · page 38 / 50
Follow breach notices through the API
With a free API key you can take the same data into your dashboard, your scripts or your own application.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/breaches?source=kvkk"