Official Breach Notices
Not the claims of gangs: data breaches disclosed by organisations, regulators and verified records.
Clash of Kings
In July 2016, the forum for the game "Clash of Kings" suffered a data breach that impacted 1.6 million subscribers. The impacted data included usernames, IP and email addresses and passwords stored as MD5 hashes. The data was provided to HIBP by dehashed.com .
Snail
In March 2015, the gaming website Snail suffered a data breach that impacted 1.4 million subscribers. The impacted data included usernames, IP and email addresses and passwords stored as unsalted MD5 hashes. The data was provided to HIBP by dehashed.com .
Flash Flash Revolution (2019 breach)
In July 2019, the music-based rhythm game Flash Flash Revolution suffered a data breach. The 2019 breach imapcted almost 1.9 million members and is in addition to the 2016 data breach of the same service . Email and IP addesses, usernames, dates of birth and salted MD5 hashes were all exposed in the breach. The data was provided with support from dehashed.com .
Stronghold Kingdoms
In July 2018, the massive multiplayer online game Stronghold Kingdoms suffered a data breach . Almost 5.2 million accounts were impacted by the incident which exposed emails addresses, usernames and passwords stored as salted SHA-1 hashes.
GameSalad
In February 2019, the education and game creation website Game Salad suffered a data breach . The incident impacted 1.5M accounts and exposed email addresses, usernames, IP addresses and passwords stored as SHA-256 hashes.
Armor Games
In January 2019, the game portal website Armor Games suffered a data breach . A total of 10.6 million email addresses were impacted by the breach which also exposed usernames, IP addresses, birthdays of administrator accounts and passwords stored as salted SHA-1 hashes.
Roll20
In December 2018, the tabletop role-playing games website Roll20 suffered a data breach . Almost 4 million customers were impacted by the breach and had email and IP addresses, names, bcrypt hashes of passwords and the last 4 digits of credit cards exposed.
Artvalue.com
In June 2019, the France-based art valuation website Artvalue.com (now defunct) left their 158k member subscriber base publicly exposed in a text file on their website. The exposed data included names, usernames, email addresses and passwords stored as MD5 hashes. The site operator did not respond when contacted about the incident, although the exposed file was subsequently removed.
EatStreet
In May 2019, the online food ordering service EatStreet suffered a data breach affecting 6.4 million customers . An extensive amount of personal data was obtained including names, phone numbers, addresses, partial credit card data and passwords stored as bcrypt hashes.
Bulgarian National Revenue Agency
In July 2019, a massive data breach of the Bulgarian National Revenue Agency began circulating with data on 5 million people . Allegedly obtained in June, the data was broadly shared online and included taxation information alongside names, phone numbers, physical addresses and 471 thousand unique email addresses. The breach is said to have affected "nearly all adults in Bulgaria".
YouNow
In February 2019, data from the live broadcasting service YouNow appeared for sale on a dark web marketplace . Whilst it's not clear what date the actual breach occurred on, the impacted data included 18M unique email addresses, IP addresses, names, usernames and links to social media profiles. As authentication is performed via social providers, no passwords were exposed in the breach. Many records didn't have associated email addresses thus the unique number is lower than the reported total number of accounts.
Animoto
In July 2018, the cloud-based video making service Animoto suffered a data breach . The breach exposed 22 million unique email addresses alongside names, dates of birth, country of origin and salted password hashes.
BlackSpigotMC
In July 2019, the hacking website BlackSpigotMC suffered a data breach . The XenForo forum based site was allegedly compromised by a rival hacking website and resulted in 8.5GB of data being leaked including the database and website itself. The exposed data included 140k unique email addresses, usernames, IP addresses, genders, geographic locations and passwords stored as bcrypt hashes.
SHEIN
In June 2018, online fashion retailer SHEIN suffered a data breach . The company discovered the breach 2 months later in August then disclosed the incident another month after that. A total of 39 million unique email addresses were found in the breach alongside MD5 password hashes.
piZap
In approximately December 2017, the online photo editing site piZap suffered a data breach . The data was later placed up for sale on a dark web marketplace along with a collection of other data breaches in February 2019. A total of 42 million unique email addresses were included in the breach alongside names, genders and links to Facebook profiles when the social media platform was used to authenticate to piZap. When accounts were created directly on piZap without using Facebook for authentication, passwords stored as SHA-1 hashes were also exposed.
Netlog
In July 2018, the Belgian social networking site Netlog identified a data breach of their systems dating back to November 2012 (PDF) . Although the service was discontinued in 2015, the data breach still impacted 49 million subscribers for whom email addresses and plain text passwords were exposed.
Evite
In April 2019, the social planning website for managing online invitations Evite identified a data breach of their systems . Upon investigation, they found unauthorised access to a database archive dating back to 2013. The exposed data included a total of 101 million unique email addresses, most belonging to recipients of invitations. Members of the service also had names, phone numbers, physical addresses, dates of birth, genders and passwords stored in plain text exposed.
Mindjolt
In March 2019, the online gaming website MindJolt suffered a data breach that exposed 28M unique email addresses . Also impacted were names and dates of birth, but no passwords.
Wiener Büchereien
In June 2019, the library of Vienna (Wiener Büchereien) suffered a data breach . The compromised data included 224k unique email addresses, names, physical addresses, phone numbers and dates of birth. The breached data was subsequently posted to Twitter by the alleged perpetrator of the breach.
Social Engineered
In June 2019, the "Art of Human Hacking" site Social Engineered suffered a data breach. The breach of the MyBB forum was published on a rival hacking forum and included 89k unique email addresses spread across 55k forum users and other tables in the database. The exposed data also included usernames, IP addresses, private messages and passwords stored as salted MD5 hashes.
1.186 notices · page 43 / 60
Follow breach notices through the API
With a free API key you can take the same data into your dashboard, your scripts or your own application.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/breaches?source=kvkk"