Tiago2024180/eyewebdataset huggingface dataset:
Pokémon Negro (pokemonnegro.com)
Breach date: 2016-10-01
Accounts affected: 830155
Data exposed: Email addresses, IP addresses, Passwords
In approximately October 2016, the Spanish Pokémon site Pokémon Negro suffered a data breach. The attack resulted in the disclosure of 830k accounts including email and IP addresses along with plain text passwords. Pokémon Negro did not respond when contacted about the breach.
PoliceOne (policeone.com)
Breach date: 2014-07-01
Accounts affected: 709926
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In February 2017, the law enforcement website PoliceOne confirmed they'd suffered a data breach. The breach contained over 700k accounts which appeared for sale by a data broker and included email and IP addresses, usernames and salted MD5 password hashes. The file the data was contained in indicated the original breach dated back to July 2014.
Polish Credentials ()
Breach date: 2023-05-29
Accounts affected: 1204870
Data exposed: Email addresses, Passwords
In May 2023, a credential stuffing list of 6.3M Polish email address and password pairs appeared on a local forum. Likely obtained by malware running on victims' machines, each record included an email address and plain text password alongside the website the credentials were used on. The data included 1.2M unique email addresses.
Poshmark (poshmark.com)
Breach date: 2018-05-16
Accounts affected: 36395491
Data exposed: Email addresses, Genders, Geographic locations, Names, Passwords, Usernames
In mid-2018, social commerce marketplace Poshmark suffered a data breach that exposed 36M user accounts. The compromised data included email addresses, names, usernames, genders, locations and passwords stored as bcrypt hashes.
Powerbot (powerbot.org)
Breach date: 2014-09-01
Accounts affected: 503501
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In approximately September 2014, the RuneScape bot website Powerbot suffered a data breach resulting in the exposure of over half a million unique user records. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory.
PPCGeeks (ppcgeeks.com)
Breach date: 2016-08-19
Accounts affected: 492518
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames
In August 2016, the pocket PC fan site forum PPCGeeks suffered a data breach that exposed over 490k records. The breach of the vBulletin forum exposed email and IP addresses, usernames, dates of birth and passwords stored as salted MD5 hashes.
Preen.Me (preen.me)
Breach date: 2020-05-25
Accounts affected: 236105
Data exposed: Email addresses, Names, Social media profiles, Usernames
In May 2020, social media marketing company Preen.Me was the target of a ransom attack that resulted in hundreds of thousands of records being publicly posted. Over 236k unique email addresses were exposed in the attack alongside names, usernames and links to social media profiles.
ProctorU (proctoru.com)
Breach date: 2020-06-26
Accounts affected: 444453
Data exposed: Email addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
In June 2020, the online exam service ProctorU suffered a data breach which was subsequently shared extensively across online hacking communities. The breach contained 444k user records including names, email and physical addresses, phones numbers and passwords stored as bcrypt hashes. The data was provided to HIBP by breachbase.pw.
Programming Forums (programmingforums.org)
Breach date: 2015-12-01
Accounts affected: 707432
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In approximately late 2015, the programming forum at programmingforums.org suffered a data breach resulting in the exposure of 707k unique user records. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory.
Promo (promo.com)
Breach date: 2020-06-22
Accounts affected: 14610585
Data exposed: Email addresses, Genders, IP addresses, Names, Passwords
In July 2020, the self-proclaimed "World's #1 Marketing Video Maker" Promo suffered a data breach which was then shared extensively on a hacking forum. The incident exposed 22 million records containing almost 15 million unique email addresses alongside IP addresses, genders, names and salted SHA-256 password hashes. The data was provided to HIBP by dehashed.com.
Promofarma (promofarma.com)
Breach date: 2019-08-03
Accounts affected: 1277761
Data exposed: Email addresses, Names
In August 2019, a data breach from the Spanish online pharmacy Promofarma appeared for sale on a dark web marketplace. The breach exposed over 2.7M records and contained almost 1.3M unique customer email addresses. The data also included customer names and was provided to HIBP by dehashed.com.
PropTiger (proptiger.com)
Breach date: 2018-01-30
Accounts affected: 2156921
Data exposed: Dates of birth, Device information, Email addresses, Genders, IP addresses, Names, Passwords
In January 2018, the Indian property website PropTiger suffered a data breach which resulted in a 3.46GB database file being exposed and subsequently shared extensively on a popular hacking forum 2 years later. The exposed data contained both user records and login histories with over 2M unique customer email addresses. Exposed data also included additional personal attributes such as names, dates of birth, genders, IP addresses and passwords stored as MD5 hashes. PropTiger advised they believe the usability of the data is "limited" due to how certain data attributes were generated and stored. The data was provided to HIBP by dehashed.com.
Prosper (prosper.com)
Breach date: 2025-09-01
Accounts affected: 17605276
Data exposed: Browser user agent details, Credit status information, Dates of birth, Email addresses, Employment statuses, Government issued IDs, Income levels, IP addresses, Names, Physical addresses
In September 2025, Prosper announced that it had detected unauthorised access to their systems, which resulted in the exposure of customer and applicant information. The data breach impacted 17.6M unique email addresses, along with other customer information, including US Social Security numbers. Prosper advised that they did not find any evidence of unauthorised access to customer accounts and funds, and that their customer-facing operations were uninterrupted. Further information about the incident is contained in Prosper's FAQs.
Protemps (protemps.com.sg)
Breach date: 2021-10-04
Accounts affected: 49591
Data exposed: Email addresses, Genders, Job applications, Marital statuses, Names, Nationalities, Passport numbers, Passwords, Phone numbers, Physical addresses, Religions, Salutations
In October 2021, the Singaporean recruitment website Protemps suffered a data breach that exposed almost 50,000 unique email addresses. The impacted data includes names, email and physical addresses, phone numbers, passport numbers and passwords stored as unsalted MD5 hashes, among troves of other jobseeker data.
Provecho (provecho.bio)
Breach date: 2026-01-30
Accounts affected: 712904
Data exposed: Email addresses, Usernames
In early 2026, data purportedly sourced from the recipe and meal planning service Provecho was alleged to have been obtained in a breach. The exposed data included 713k unique email address along with username and the creator account holders followed. Provecho has been notified and is aware of the claims surrounding the incident.
PS3Hax (ps3hax.net)
Breach date: 2015-07-01
Accounts affected: 447410
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In approximately July 2015, the Sony Playstation hacks and mods forum known as PS3Hax was hacked and more than 447k accounts were exposed. The vBulletin forum included IP addresses and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked.
PSP ISO (pspiso.com)
Breach date: 2015-09-25
Accounts affected: 1274070
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In approximately September 2015, the PlayStation PSP forum known as PSP ISO was hacked and almost 1.3 million accounts were exposed. Along with email and IP addresses, the vBulletin forum also exposed salted MD5 password hashes.
PSX-Scene (psx-scene.com)
Breach date: 2015-02-01
Accounts affected: 341118
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In approximately February 2015, the Sony Playstation forum known as PSX-Scene was hacked and more than 340k accounts were exposed. The vBulletin forum included IP addresses and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked.
Public Business Data (bvdinfo.com)
Breach date: 2021-08-19
Accounts affected: 27917714
Data exposed: Dates of birth, Email addresses, Job titles, Names, Phone numbers, Physical addresses
In approximately August 2021, hundreds of gigabytes of business data collated from public sources was obtained and later published to a popular hacking forum. Sourced from a customer of Bureau van Dijk's (BvD) "Orbis" product, the corpus of data released contained hundreds of millions of lines about corporations and individuals, including personal information such as names and dates of birth. The data also included 28M unique email addresses along with physical addresses (presumedly corporate locations), phone numbers and job titles. There was no unauthorised access to BvD's systems, nor did the incident expose any of their or parent company's Moody's clients.
Qakbot ()
Breach date: 2023-08-29
Accounts affected: 6431319
Data exposed: Email addresses, Passwords
In August 2023, the US Justice Department announced a multinational operation involving actions in the United States, France, Germany, the Netherlands, and the United Kingdom to disrupt the botnet and malware known as Qakbot and take down its infrastructure. After the takedown, 6.43M email addresses were provided to HIBP to help notify victims of the malware.
Qatar National Bank (qnb.com)
Breach date: 2015-07-01
Accounts affected: 88678
Data exposed: Bank account numbers, Customer feedback, Dates of birth, Financial transactions, Genders, Geographic locations, Government issued IDs, IP addresses, Marital statuses, Names, Passwords, Phone numbers, Physical addresses, PINs, Security questions and answers, Spoken languages
In July 2015, the Qatar National Bank suffered a data breach which exposed 15k documents totalling 1.4GB and detailing more than 100k accounts with passwords and PINs. The incident was made public some 9 months later in April 2016 when the documents appeared publicly on a file sharing site. Analysis of the breached data suggests the attack began by exploiting a SQL injection flaw in the bank's website.
QIP (qip.ru)
Breach date: 2011-06-01
Accounts affected: 26183992
Data exposed: Email addresses, Passwords, Usernames, Website activity
In mid-2011, the Russian instant messaging service known as QIP (Quiet Internet Pager) suffered a data breach. The attack resulted in the disclosure of over 26 million unique accounts including email addresses and passwords with the data eventually appearing in public years later.
Qraved (qraved.com)
Breach date: 2021-07-09
Accounts affected: 984519
Data exposed: Dates of birth, Email addresses, Names, Passwords, Phone numbers
In July 2021, the Indonesian restaurant website Qraved suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed almost 1M unique email addresses along with names, phone numbers, dates of birth and passwords stored as MD5 hashes.
Quantum Booter (quantumbooter.net)
Breach date: 2014-03-18
Accounts affected: 48592
Data exposed: Email addresses, IP addresses, Passwords, Private messages, Usernames, Website activity
In March 2014, the booter service Quantum Booter (also referred to as Quantum Stresser) suffered a breach which lead to the disclosure of their internal database. The leaked data included private discussions relating to malicious activity Quantum Booter users were performing against online adversaries, including the IP addresses of those using the service to mount DDoS attacks.
QuestionPro (questionpro.com)
Breach date: 2022-05-21
Accounts affected: 22229637
Data exposed: Browser user agent details, Email addresses, IP addresses, Survey results
In May 2022, the survey website QuestionPro was the target of an extortion attempt relating to an alleged data breach. Over 100GB of data containing 22M unique email addresses (some of which appear to be generated by the platform), are alleged to have been extracted from the service along with IP addresses, browser user agents and results relating to surveys. QuestionPro would not confirm whether a breach had occurred (although they did confirm they were the target of an extortion attempt), so the data was initially flagged as "unverified". Subsequent verification by impacted HIBP subscribers later led to the removal of the unverified flag.
Quidd (quidd.co)
Breach date: 2019-07-01
Accounts affected: 3805863
Data exposed: Email addresses, Passwords, Usernames
In 2019, online marketplace for trading stickers, cards, toys, and other collectibles Quidd suffered a data breach. The breach exposed almost 4 million users' email addresses, usernames and passwords stored as bcrypt hashes. The data was subsequently sold then redistributed extensively via hacking forums.
QuinStreet (quinstreet.com)
Breach date: 2015-12-14
Accounts affected: 4907802
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames, Website activity
In approximately late 2015, the maker of "performance marketing products" QuinStreet had a number of their online assets compromised. The attack impacted 28 separate sites, predominantly technology forums such as flashkit.com, codeguru.com and webdeveloper.com (view a full list of sites). QuinStreet advised that impacted users have been notified and passwords reset. The data contained details on over 4.9 million people and included email addresses, dates of birth and salted MD5 hashes.
Quitbro (quitbro.app)
Breach date: 2026-02-17
Accounts affected: 22874
Data exposed: Email addresses, Partial dates of birth, Usernames
In February 2026, the porn addiction app Quitbro allegedly suffered a data breach that exposed 23k unique email addresses. The data also included users’ years of birth, responses to questions within the app and their last recorded relapse time. The app’s maker, Plantake, did not respond to multiple attempts to contact them about the incident.
R2 (2017 forum breach) (r2games.com)
Breach date: 2017-01-01
Accounts affected: 1023466
Data exposed: Email addresses, Passwords, Usernames, Website activity
In early 2017, the forum for the gaming website R2 Games was hacked. R2 had previously appeared on HIBP in 2015 after a prior incident. This one exposed over 1 million unique user accounts and corresponding MD5 password hashes with no salt.
R2Games (r2games.com)
Breach date: 2015-11-01
Accounts affected: 22281337
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In late 2015, the gaming website R2Games was hacked and more than 2.1M personal records disclosed. The vBulletin forum included IP addresses and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked. A further 11M accounts were added to "Have I Been Pwned" in March 2016 and another 9M in July 2016 bringing the total to over 22M.
Raaga (raaga.com)
Breach date: 2025-12-15
Accounts affected: 10225145
Data exposed: Ages, Dates of birth, Email addresses, Genders, Geographic locations, Names, Passwords
In December 2025, data allegedly breached from the Indian streaming music service "Raaga" was posted for sale to a popular hacking forum. The data contained 10M unique email addresses along with names, genders, ages (in some cases, full date of birth), postcodes and passwords stored as unsalted MD5 hashes.
RaidForums (raidforums.com)
Breach date: 2020-09-24
Accounts affected: 478604
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames
In May 2023, 478k user records from the now defunct hacking forum known as "RaidForums" was posted to another hacking forum. The data dated back to September 2020 and included email addresses, usernames, dates of birth, IP addresses and passwords stored as Argon2 hashes.
RailYatri (railyatri.in)
Breach date: 2022-12-26
Accounts affected: 23209732
Data exposed: Email addresses, Genders, Names, Phone numbers, Purchases
In December 2022, India’s government-approved online travel agency RailYatri suffered a data breach. The incident impacted over 31M customers and exposed 23M unique email addresses. Also impacted were names, genders, phone numbers and tickets purchased, including travel information and fares.
Rambler (rambler.ru)
Breach date: 2014-03-01
Accounts affected: 91436280
Data exposed: Email addresses, Passwords, Usernames
In late 2016, a data dump of almost 100M accounts from Rambler, sometimes referred to as "The Russian Yahoo", was discovered being traded online. The data set provided to Have I Been Pwned included 91M unique usernames (which also form part of Rambler email addresses) and plain text passwords. According to Rambler, the data dates back to March 2014.
RankWatch (rankwatch.com)
Breach date: 2016-11-19
Accounts affected: 7445067
Data exposed: Email addresses, Employers, Job titles, Names, Phone numbers
In approximately November 2016, the search engine optimisation management company RankWatch exposed a Mongo DB with no password publicly whereupon their data was exfiltrated and posted to an online forum. The data contained 7.4 million unique email addresses along with names, employers, phone numbers and job titles in a table called "us_emails". When contacted and advised of the incident, RankWatch would not reveal the purpose of the data, where it had been acquired from and whether the data owners had consented to its collection. The forum which originally posted the data explained it as being "in the same vein as the modbsolutions leak", a large list of corporate data allegedly used for spam purposes.
Raychat (raychat.ir)
Breach date: 2021-01-31
Accounts affected: 938981
Data exposed: Browser user agent details, Email addresses, IP addresses, Names, Passwords
In January 2021, the now defunct Iranian social media platform Raychat suffered a data breach that exposed 939 thousand unique email addresses. The data included names, IP addresses, browser user agent strings and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
Rbx.Rocks (rbx.rocks)
Breach date: 2018-08-06
Accounts affected: 149958
Data exposed: Email addresses, Names, Passwords
In August 2018, the Roblox trading site Rbx.Rocks suffered a data breach. Almost 25k records were sent to HIBP in November and included names, email addresses and passwords stored as bcrypt hashes. In July 2019, a further 125k records emerged bringing the total size of the incident to 150k. The website has since gone offline with a message stating that "Rbx.Rocks v2.0 is currently under construction".
Read Novel (readnovel.com)
Breach date: 2019-05-01
Accounts affected: 22424472
Data exposed: Email addresses, Genders, Passwords, Phone numbers, Usernames
In May 2019, the Chinese literature website Read Novel allegedly suffered a data breach that exposed 22M unique email addresses. Data also included usernames, genders, phone numbers and passwords stored as salted MD5 hashes. Read more about Chinese data breaches in Have I Been Pwned.
Real Estate Mogul (realestatemogul.com)
Breach date: 2016-09-06
Accounts affected: 307768
Data exposed: Email addresses, Names, Phone numbers, Physical addresses
In September 2016, the real estate investment site Real Estate Mogul had a Mongo DB instance compromised and 5GB of data downloaded by an unauthorised party. The data contained real estate listings including addresses and the names, phone numbers and 308k unique email addresses of the sellers. Real Estate Mogul was advised of the incident in September 2018 and stated that they "found no instance of user account credentials like usernames and passwords nor billing information within this file".
RealDudesInc (realdudesinc.com)
Breach date: 2022-10-22
Accounts affected: 101543
Data exposed: Email addresses, Passwords, Usernames
In October 2022, the GTA mod menu provider RealDudesInc suffered a data breach that exposed over 100k email addresses (many of which are temporary guest account addresses). The breach also included usernames and bcrypt password hashes.
RedDoorz (reddoorz.com)
Breach date: 2020-09-04
Accounts affected: 5890277
Data exposed: Dates of birth, Email addresses, Genders, Names, Occupations, Passwords, Phone numbers
In September 2020, the hotel management & booking platform RedDoorz suffered a data breach that exposed over 5.8M user accounts. The breached data included names, email addresses, phone numbers, genders, dates of birth and passwords stored as bcrypt hashes.
RedLine Stealer ()
Breach date: 2021-12-05
Accounts affected: 441657
Data exposed: Email addresses, Passwords, Usernames
In December 2021, logs from the RedLine Stealer malware were left publicly exposed and were then obtained by security researcher Bob Diachenko. The data included 441 thousand unique email addresses, usernames and plain text passwords.
Regpack (bluesnap.com)
Breach date: 2016-05-20
Accounts affected: 104977
Data exposed: Browser user agent details, Credit card CVV, Email addresses, IP addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases
In July 2016, a tweet was posted with a link to an alleged data breach of BlueSnap, a global payment gateway and merchant account provider. The data contained 324k payment records across 105k unique email addresses and included personal attributes such as name, home address and phone number. The data was verified with multiple Have I Been Pwned subscribers who confirmed it also contained valid transactions, partial credit card numbers, expiry dates and CVVs. A downstream consumer of BlueSnap services known as Regpack was subsequently identified as the source of the data after they identified human error had left the transactions exposed on a publicly facing server. A full investigation of the data and statement by Regpack is detailed in the post titled Someone just lost 324k payment records, complete with CVVs.
Reincubate (reincubate.com)
Breach date: 2017-05-11
Accounts affected: 616146
Data exposed: Email addresses, Names, Passwords
In October 2020, the app data company Reincubate suffered a data breach which exposed a backup from November 2017 (the newest record in the data appeared several months earlier). The data included over 616k unique email addresses, names and passwords stored as PBKDF2 hashes.
RentoMojo (rentomojo.com)
Breach date: 2023-04-15
Accounts affected: 2185697
Data exposed: Dates of birth, Email addresses, Genders, Government issued IDs, Names, Passport numbers, Passwords, Phone numbers, Purchases, Social media profiles
In April 2023, the Indian rental service RentoMojo suffered a data breach. The breach exposed over 2M unique email addresses along with names, phone, passport and Aadhaar numbers, genders, dates of birth, purchases and bcrypt password hashes.
Republican Party of Texas (texasgop.org)
Breach date: 2021-09-11
Accounts affected: 72596
Data exposed: Browser user agent details, Email addresses, Geographic locations, IP addresses, Names
In September 2021, the Republican Party of Texas was hacked by a group claiming to be "Anonymous" in retaliation for the state's controversial abortion ban. The September defacement was followed by a leak of data and documents which included material from the hosting provider Epik. Impacted data included over 72 thousand unique email addresses across various tables, some also including names, geographic location data, IP addresses and browser user agents.