21 casos · pág. 1/2
In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates. The breach exposed roughly 145k unique email addresses along with usernames and passwords stored as MD5 or PBKDF2 hashes. OTW self-submitted the data to Have I Been Pwned, which added it on 19 Aug 2026 (144.5k af…
In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign. The group published a substantial corpus of data allegedly taken from the company, including 6.4M unique email addresses alongside other personal and corporate attributes. The data relates to marketing campaign r…
In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool. The company's disclosure notice states that attackers accessed a subset of its data. That data was later published publicly and contains about 275k unique email addresses and Discord us…
In August 2026, the food and animal safety company Neogen was targeted in a ShinyHunters "pay or leak" extortion attempt. The group later published data it claimed to have obtained from Neogen. The data consists largely of corporate contact records and includes 436k unique email addresses drawn from mailing lists, employee records and oth…
In July 2026, the cloud-based business communications platform RingCentral was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data it claimed to have obtained from the platform, covering 1.6M unique email addresses along with names, physical addresses and phone numbers. RingCentral stated in …
In August 2026, clothing retailer Carhartt was targeted in a ShinyHunters "pay or leak" extortion campaign. The group published data allegedly taken from the company, including 12.9M unique email addresses, names, phone numbers and physical addresses. The leaked corpus also held millions of synthetic records unrelated to real individuals,…
In August 2026, Australian beauty retailer Oz Hair and Beauty was targeted in an extortion attack by the group xpl0itrs. The group subsequently published data allegedly stolen from the company. The leak contains roughly 2M unique email addresses along with names, phone numbers, geographic locations (suburb and postcode) and purchase recor…
In August 2026, a dataset of 7.3M rows allegedly sourced from Chess.com was posted online, containing 4.6M unique email addresses. The data also included usernames, names, countries and account-related data. Analysis suggests the data was obtained by scraping rather than a direct breach of Chess.com systems. Have I Been Pwned added it on …
In August 2026, French intellectual property software and services company Questel was targeted in a ShinyHunters "pay or leak" extortion campaign. The group published a large corpus of data it claimed to have taken from the company. The data is largely corporate contact information tied to sales leads, support cases and marketing activit…
In September 2026, Swiss medical device company Medela was targeted in a ShinyHunters "pay or leak" extortion campaign. The data allegedly obtained in the breach was later published and covers about 424k unique email addresses, mostly belonging to healthcare professionals, Medela staff and sales leads. Have I Been Pwned added the dataset …
The now-defunct B2B marketing leads service LimeLeads suffered a data breach in August 2019 after an Elasticsearch server was left exposed and unsecured. The incident exposed tens of millions of records of largely corporate contact data, covering 17.8M unique email addresses. Have I Been Pwned added the dataset on 22 Sep 2026. The article…
In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, including roughly 118k unique email addresses. Have I Been Pwned added the dataset on 18 Oct 2026, with 117.6k affected addresses. The article do…
In mid-2026, user records allegedly taken from Golf Canada began circulating on Telegram, and Have I Been Pwned added them to its database on 22 Aug 2026. The dataset covers 569k unique email addresses with names, usernames, dates of birth, genders and approximate locations (city, province, postcode). The breach is dated May 2026. It is u…
In July 2025, the German news service NIUS suffered a data breach whose data was subsequently leaked publicly. Have I Been Pwned added the dataset on 23 Aug 2026. It covers 6k unique email addresses along with names, physical addresses and payment details tied to purchases. HIBP flagged the breach as sensitive, so it is not publicly searc…
In August 2026, Manchester Airports Group (MAG) disclosed a data breach affecting its services. The FulcrumSec hacking group later claimed the incident and published data relating to 8.8M customers of Manchester, Stansted and East Midlands airports. The leaked data includes email addresses and phone numbers, along with airport service rec…
A breach of the Mindbox marketing automation platform in August 2024 exposed data belonging to Burger King Russia customers. News of the incident broke in October 2024, and the dataset was added to Have I Been Pwned on 21 Sep 2026. It contains 3.2M unique email addresses along with names, genders, dates of birth, phone numbers and approxi…
In August 2026, data centre operator CyrusOne was targeted in a ShinyHunters "pay or leak" extortion attempt. The group later published data allegedly stolen from the company, covering about 373k unique email addresses across records for users, sales leads and CyrusOne employees. The data is mostly corporate contact information, and also …
In January 2026, the company intelligence platform Crunchbase was targeted in a ShinyHunters "pay or leak" extortion attempt. Data allegedly stolen from the company was later published, covering about 560k unique email addresses, mostly belonging to leads and business contacts. Crunchbase subsequently confirmed that a threat actor had exf…
Indian stock brokerage Angel One confirmed in July 2024 that data leaked online came from a breach that occurred in April 2023. The leak holds 7.9M user records covering 6.8M unique email addresses. It was added to Have I Been Pwned on 7 Oct 2026. Angel One stated the breach "has no impact on client securities, funds, or credentials". The…
In September 2024 the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries. The dataset was added to Have I Been Pwned on 20 Oct 2026 and contains 70.4k unique email addresses. Exposed data includes names, dates of birth, physical addresses, phone numbers, income leve…
