Tiago2024180/eyewebdataset huggingface dataset:
Manipulated Caiman ()
Breach date: 2023-07-16
Accounts affected: 39901389
Data exposed: Email addresses
In July 2023, Perception Point reported on a phishing operation dubbed "Manipulated Caiman". Targeting primarily the citizens of Mexico, the campaign attempted to gain access to victims' bank accounts via spear phishing attacks using malicious attachments. Researchers obtained almost 40M email addresses targeted in the campaign and provided the data to HIBP to alert potential victims.
Mappery (mappery.com)
Breach date: 2018-12-11
Accounts affected: 205242
Data exposed: Email addresses, Geographic locations, Passwords, Usernames
In December 2018, the mapping website Mappery suffered a data breach that exposed over 205k unique email addresses. The incident also exposed usernames, the geographic location of the user and passwords stored as unsalted SHA-1 hashes. No response was received from Mappery when contacted about the incident.
MaReads (mareads.com)
Breach date: 2025-06-22
Accounts affected: 74453
Data exposed: Dates of birth, Email addresses, Phone numbers, Usernames
In June 2025, MaReads, the website for readers and writers of Thai-language fiction and comics suffered a data breach that exposed 74k records. The breach included usernames, email addresses, phone numbers and dates of birth. MaReads is aware of the breach.
Market Moveis (marketmoveis.pt)
Breach date: 2023-08-30
Accounts affected: 28220
Data exposed: Email addresses, Names
In August 2023, the Portuguese home decor company Market Moveis suffered a data breach that impacted 28k records. The exposed records were limited to names and email addresses.
Mashable (mashable.com)
Breach date: 2020-06-01
Accounts affected: 1414677
Data exposed: Auth tokens, Email addresses, Genders, Geographic locations, IP addresses, Names, Partial dates of birth, Social media profiles
In approximately mid-2020, Mashable suffered a data breach that subsequently turned up publicly in November 2020. The data included 1.4 million unique email addresses along with names, genders, expired auth tokens, physical locations, links to social media profiles and days and months of birth. The data was provided to HIBP by dehashed.com.
Master Deeds ()
Breach date: 2017-03-14
Accounts affected: 2257930
Data exposed: Dates of birth, Deceased statuses, Email addresses, Employers, Ethnicities, Genders, Government issued IDs, Home ownership statuses, Job titles, Names, Nationalities, Phone numbers, Physical addresses
In March 2017, a 27GB database backup file named "Master Deeds" was sent to HIBP by a supporter of the project. Upon detailed analysis later that year, the file was found to contain the personal data of tens of millions of living and deceased South African residents. The data included extensive personal attributes such as names, addresses, ethnicities, genders, birth dates, government issued personal identification numbers and 2.2 million email addresses. At the time of publishing, it's alleged the data was sourced from Dracore Data Sciences (Dracore is yet to publicly confirm or deny the data was sourced from their systems). On 18 October 2017, the file was found to have been published to a publicly accessible web server where it was located at the root of an IP address with directory listing enabled. The file was dated 8 April 2015.
Mastercard Priceless Specials (specials.mastercard.de)
Breach date: 2019-08-20
Accounts affected: 89388
Data exposed: Email addresses, IP addresses, Names, Partial credit card data, Phone numbers, Salutations
In August 2019, the German Mastercard bonus program "Priceless Specials" suffered a data breach. Personal data on almost 90k program members was subsequently extensively circulated online and included names, email and IP addresses, phone numbers and partial credit card data. Following the incident, the program was subsequently suspended.
Mate1.com (mate1.com)
Breach date: 2016-02-29
Accounts affected: 27393015
Data exposed: Astrological signs, Dates of birth, Drinking habits, Drug habits, Education levels, Email addresses, Ethnicities, Fitness levels, Genders, Geographic locations, Income levels, Job titles, Names, Parenting plans, Passwords, Personal descriptions, Physical attributes, Political views, Relationship statuses, Religions, Sexual fetishes, Travel habits, Usernames, Website activity, Work habits
In February 2016, the dating site mate1.com suffered a huge data breach resulting in the disclosure of over 27 million subscribers' information. The data included deeply personal information about their private lives including drug and alcohol habits, incomes levels and sexual fetishes as well as passwords stored in plain text.
Mathway (mathway.com)
Breach date: 2020-01-13
Accounts affected: 25692862
Data exposed: Device information, Email addresses, Names, Passwords, Social media profiles
In January 2020, the math solving website Mathway suffered a data breach that exposed over 25M records. The data was subsequently sold on a dark web marketplace and included names, Google and Facebook IDs, email addresses and salted password hashes.
MC2 Data ()
Breach date: 2024-08-18
Accounts affected: 2122280
Data exposed: Email addresses, Names, Passwords
In August 2024, data aggregator MC2 Data left a database publicly accessible without a password which was subsequently discovered by a security researcher. The breach exposed the personal information of 2.1M subscribers to the service which was marketed under a series of different brand names. The data included email addresses, names and salted SHA-256 password hashes.
MCBans (mcbans.com)
Breach date: 2016-10-27
Accounts affected: 119948
Data exposed: Email addresses, IP addresses, Passwords, Usernames, Website activity
In October 2016, the Minecraft banning service known as MCBans suffered a data breach resulting in the exposure of 120k unique user records. The data contained email and IP addresses, usernames and password hashes of unknown format. The site was previously reported as compromised on the Vigilante.pw breached database directory.
MDPI (mdpi.com)
Breach date: 2016-08-30
Accounts affected: 845012
Data exposed: Email addresses, Email messages, IP addresses, Names
In August 2016, the Swiss scholarly open access publisher known as MDPI had 17.5GB of data obtained from an unprotected Mongo DB instance. The data contained email exchanges between MDPI and their authors and reviewers which included 845k unique email addresses. MDPI have confirmed that the system has since been protected and that no data of a sensitive nature was impacted. As such, they concluded that notification to their subscribers was not necessary due to the fact that all their authors and reviewers are available online on their website.
Mecho Download (mechodownload.com)
Breach date: 2013-10-31
Accounts affected: 437928
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In October 2013, the (now defunct) downloads website "Mecho Download" suffered a data breach that exposed 438k records. Data from the vBulletin based website included email and IP addresses, usernames and passwords stored as salted MD5 hashes.
MediaWorks (mediaworks.co.nz)
Breach date: 2023-03-15
Accounts affected: 162710
Data exposed: Dates of birth, Email addresses, Genders, Phone numbers, Physical addresses
In March 2024, millions of rows of data from the New Zealand media company MediaWorks was publicly posted to a popular hacking forum. The incident exposed 163k unique email addresses provided by visitors who filled out online competitions and included names, physical addresses, phone numbers, dates of birth, genders and the responses to questions in the competition. Some victims of the breach subsequently received ransom demands requesting payment to have their data deleted.
MeetMindful (meetmindful.com)
Breach date: 2020-01-26
Accounts affected: 1422717
Data exposed: Dates of birth, Drinking habits, Drug habits, Email addresses, Genders, Geographic locations, IP addresses, Marital statuses, Names, Passwords, Physical attributes, Religions, Sexual orientations, Smoking habits, Social media profiles, Usernames
In early 2020, the online dating service MeetMindful suffered a data breach that exposed 1.4 million unique customer email addresses. Included in the data was an extensive array of personal information used to find romantic matches including physical attributes, use of alcohol, drugs and cigarettes, marital statuses, birthdates, genders and the gender being sought. Additional personal information such as names, geographical locations and IP addresses were also exposed, along with passwords stored as bcrypt hashes.
MemeChat (memechat.app)
Breach date: 2022-06-01
Accounts affected: 4348570
Data exposed: Email addresses, Usernames
In mid-2022, "the ultimate hub of memes" MemeChat suffered a data breach that exposed 7.4M records. Alleged to be due to a misconfigured Elasticsearch instance, the data contained 4.3M unique email addresses alongside usernames.
MEO (meoair.com)
Breach date: 2020-12-24
Accounts affected: 8227
Data exposed: Email addresses, Names, Passwords, Phone numbers, Physical addresses, Purchases, Usernames
In early 2023, a corpus of data sourced from the New Zealand based face mask company MEO was discovered. Dating back to December 2020, the data contained over 8k customer records including names, addresses, phone numbers and passwords stored as MD5 Wordpress hashes. MEO did not respond to multiple attempts to report the breach.
MGM Resorts (mgmresorts.com)
Breach date: 2019-07-25
Accounts affected: 3081321
Data exposed: Dates of birth, Email addresses, Names, Phone numbers, Physical addresses
In July 2019, MGM Resorts discovered a data breach of one of their cloud services. The breach included 10.6M guest records with 3.1M unique email addresses stemming back to 2017. The exposed data included email and physical addresses, names, phone numbers and dates of birth and was subsequently shared on a popular hacking forum in February 2020 where it was extensively redistributed. The data was provided to HIBP by Under The Breach.
MGM Resorts (2022 Update) (mgmresorts.com)
Breach date: 2019-07-25
Accounts affected: 24842001
Data exposed: Dates of birth, Email addresses, Names, Phone numbers, Physical addresses
In July 2019, MGM Resorts discovered a data breach of one of their cloud services. The breach included 10.6M guest records with 3.1M unique email addresses stemming back to 2017. In May 2022, a superset of the data totalling almost 25M unique email addresses across 142M rows was extensively shared on Telegram. On analysis, it's highly likely the data stems from the same incident with 142M records having been discovered for sale on a dark web marketplace in mid-2020. The exposed data included email and physical addresses, names, phone numbers and dates of birth.
Miljödata (miljodata.se)
Breach date: 2025-08-25
Accounts affected: 870108
Data exposed: Dates of birth, Email addresses, Genders, Government issued IDs, Names, Phone numbers, Physical addresses
In August 2025, the Swedish system supplier Miljödata was the victim of a ransomware attack. Following the attack, data was subsequently published on the dark web and included 870k unique email addresses across various compromised files. Data also included names, phone numbers, physical addresses, dates of birth and government-issued personal identity numbers.
Mindjolt (mindjolt.com)
Breach date: 2019-03-18
Accounts affected: 28364826
Data exposed: Dates of birth, Email addresses, Names
In March 2019, the online gaming website MindJolt suffered a data breach that exposed 28M unique email addresses. Also impacted were names and dates of birth, but no passwords.
Minecraft Pocket Edition Forum (minecraftpeforum.net)
Breach date: 2015-05-24
Accounts affected: 16034
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In May 2015, the Minecraft Pocket Edition forum was hacked and over 16k accounts were dumped public. Allegedly hacked by @rmsg0d, the forum data included numerous personal pieces of data for each user. The forum has subsequently been decommissioned.
Minecraft World Map (minecraftworldmap.com)
Breach date: 2016-01-15
Accounts affected: 71081
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In approximately January 2016, the Minecraft World Map site designed for sharing maps created for the game was hacked and over 71k user accounts were exposed. The data included usernames, email and IP addresses along with salted and hashed passwords.
Minefield (minefield.fr)
Breach date: 2015-06-28
Accounts affected: 188343
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames, Website activity
In June 2015, the French Minecraft server known as Minefield was hacked and 188k member records were exposed. The IP.Board forum included email and IP addresses, birth dates and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked.
Minehut (minehut.com)
Breach date: 2019-05-17
Accounts affected: 396533
Data exposed: Email addresses, Passwords
In May 2019, the Minecraft server website Minehut suffered a data breach. The company advised a database backup had been obtained after which they subsequently notified all impacted users. 397k email addresses from the incident were provided to HIBP. A data set with both email addresses and bcrypt password hashes was also later provided to HIBP.
Minted (minted.com)
Breach date: 2020-05-06
Accounts affected: 4418182
Data exposed: Email addresses, Names, Passwords, Phone numbers, Physical addresses
In May 2020, the online marketplace for independent artists Minted suffered a data breach that exposed 4.4M unique customer records subsequently sold on a dark web marketplace. Exposed data also included names, physical addresses, phone numbers and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
Misattributed Flipkart Data ()
Breach date: 2022-09-02
Accounts affected: 552094
Data exposed: Email addresses, Geographic locations, Names, Phone numbers
In September 2022, over 500k customer records alleged to have been sourced from the Indian e-commerce service Flipkart appeared on a popular hacking forum. Flipkart subsequently reviewed the data and concluded there was minimal overlap with their subscriber base and was not sourced from their services. The data included email addresses, latitudes and longitudes, names and phone numbers.
Misattributed Habib's Data (habibs.com.br)
Breach date: 2021-08-05
Accounts affected: 3517679
Data exposed: Dates of birth, Email addresses, IP addresses, Names, Phone numbers, Social media profiles
In August 2021, an allegation was made that the Brazilian fast food company "Habib's" had suffered a data breach that was later redistributed as part of a larger corpus of data. Upon thorough investigation, parent company Gennius concluded that the information in the breach was not related to any databases that hold their customers' personal information and had been misattributed to Habib's. The corpus of data contained 3.5M unique email addresses along with IP addresses, names, phone numbers, dates of birth and links to social media profiles.
MMG Fusion (mmgfusion.com)
Breach date: 2020-12-20
Accounts affected: 2660295
Data exposed: Appointments, Dates of birth, Email addresses, Genders, Marital statuses, Names, Passwords, Phone numbers, Physical addresses
In December 2020, the dental practice management service MMG Fusion was the victim of a data breach which exposed 2.6M unique email addresses. The data also included patient appointments, names, phone numbers, dates of birth, genders and physical addresses. A small number of records also included passwords stored as bcrypt hashes.
MobiFriends (mobifriends.com)
Breach date: 2020-01-06
Accounts affected: 3512952
Data exposed: Dates of birth, Email addresses, Genders, Passwords, Usernames
In January 2020, the Barcelona-based dating app MobiFriends suffered a data breach that exposed 3.5 million unique email addresses. The data also included usernames, genders, dates of birth and MD5 password hashes.
MoDaCo (modaco.com)
Breach date: 2016-01-01
Accounts affected: 879703
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In approximately January 2016, the UK based Android community known as MoDaCo suffered a data breach which exposed 880k subscriber identities. The data included email and IP addresses, usernames and passwords stored as salted MD5 hashes.
Modern Business Solutions (modbsolutions.com)
Breach date: 2016-10-08
Accounts affected: 58843488
Data exposed: Dates of birth, Email addresses, Genders, IP addresses, Job titles, Names, Phone numbers, Physical addresses
In October 2016, a large Mongo DB file containing tens of millions of accounts was shared publicly on Twitter (the file has since been removed). The database contained over 58M unique email addresses along with IP addresses, names, home addresses, genders, job titles, dates of birth and phone numbers. The data was subsequently attributed to "Modern Business Solutions", a company that provides data storage and database hosting solutions. They've yet to acknowledge the incident or explain how they came to be in possession of the data.
Money Bookers (moneybookers.com)
Breach date: 2009-01-01
Accounts affected: 4483605
Data exposed: Dates of birth, Email addresses, IP addresses, Names, Phone numbers, Physical addresses
Sometime in 2009, the e-wallet service known as Money Bookers suffered a data breach which exposed almost 4.5M customers. Now called Skrill, the breach was not discovered until October 2015 and included names, email addresses, home addresses and IP addresses.
Moneycontrol (moneycontrol.com)
Breach date: 2017-09-07
Accounts affected: 762874
Data exposed: Email addresses, Genders, Geographic locations, Passwords, Phone numbers
In April 2021, hackers posted data for sale originating from the online Indian financial platform, Moneycontrol. The data included 763 thousand unique email addresses (allegedly a subset of a larger 40 million account breach), alongside geographic locations, phone numbers, genders, dates of birth and plain text passwords. The date of the original breach is unclear, although the breached data indicates the file was created in September 2017 and Moneycontrol has stated that the breach is "an old data set".
Morele.net (morele.net)
Breach date: 2018-10-10
Accounts affected: 2467304
Data exposed: Email addresses, Names, Passwords, Phone numbers
In October 2018, the Polish e-commerce website Morele.net suffered a data breach. The incident exposed almost 2.5 million unique email addresses alongside phone numbers, names and passwords stored as md5crypt hashes.
Mortal Online (mortalonline.com)
Breach date: 2018-06-17
Accounts affected: 606637
Data exposed: Email addresses, Names, Passwords, Physical addresses, Usernames
In June 2018, the massively multiplayer online role-playing game (MMORPG) Mortal Online suffered a data breach. A file containing 570k email addresses and cracked passwords was subsequently distributed online. A larger more complete file containing 607k email addresses with original unsalted MD5 password hashes along with names, usernames and physical addresses was later provided and the original breach in HIBP was updated accordingly. The data was provided to HIBP by whitehat security researcher and data analyst Adam Davies.
Movie Forums (movieforums.com)
Breach date: 2022-11-24
Accounts affected: 39914
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames
In December 2022, the Movie Forums website suffered a data breach that affected 40k users. The breach exposed email and IP addresses, usernames, dates of birth and passwords stored as easily crackable salted MD5 hashes. The data was subsequently posted a popular clear web hacking forum.
MovieBoxPro (movieboxpro.app)
Breach date: 2024-04-15
Accounts affected: 6009014
Data exposed: Email addresses, Usernames
In April 2024, over 6M records from the streaming service MovieBoxPro were scraped from a vulnerable API. Of questionable legality, the service provided no contact information to disclose the incident, although reportedly the vulnerability was rectified after being mass enumerated.
MPGH (mpgh.net)
Breach date: 2015-10-22
Accounts affected: 3122898
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In October 2015, the multiplayer game hacking website MPGH was hacked and 3.1 million user accounts disclosed. The vBulletin forum breach contained usernames, email addresses, IP addresses and salted hashes of passwords.
Mr. Green Gaming (mrgreengaming.com)
Breach date: 2024-03-01
Accounts affected: 27123
Data exposed: Dates of birth, Email addresses, Geographic locations, IP addresses, Usernames
In March 2024, the online games community Mr. Green Gaming suffered a data breach that exposed 27k user records. Acknowledged on their Discord server, the incident exposed email and IP addresses, usernames, geographic locations and dates of birth.
MrExcel (mrexcel.com)
Breach date: 2016-12-05
Accounts affected: 366140
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Social connections, Usernames, Website activity
In December 2016, the forum for the Microsoft Excel tips and solutions site Mr Excel suffered a data breach. The hack of the vBulletin forum led to the exposure of over 366k accounts along with email and IP addresses, dates of birth and salted passwords hashed with MD5. The owner of the MrExcel forum subsequently self-submitted the data to HIBP.
MSI (msi.com)
Breach date: 2024-07-07
Accounts affected: 249990
Data exposed: Email addresses, Names, Phone numbers, Physical addresses, Warranty claims
In July 2024, MSI inadvertently exposed hundreds of thousands of customer records related to RMA claims that were subsequently found to be publicly accessible. The data included 250k unique email addresses alongside names, phone numbers, physical addresses and warranty claims. When contacted about the incident, MSI advised that "there is no evidence the information was ever accessed" and that "the security incident we had did not trigger state data breach notification obligations" due to the absence of "(social security number, driver's license number….etc)".
mSpy (mspy.com)
Breach date: 2015-05-14
Accounts affected: 699793
Data exposed: Device usage tracking data
In May 2015, the "monitoring" software known as mSpy suffered a major data breach. The software (allegedly often used to spy on unsuspecting victims), stored extensive personal information within their online service which after being breached, was made freely available on the internet.
mSpy (2024) (mspy.com)
Breach date: 2024-06-09
Accounts affected: 2394179
Data exposed: Email addresses, IP addresses, Names, Photos
In June 2024, a huge trove of data from spyware maker mSpy was obtained by hacktivists and published online. Comprising of 142GB of user data and support tickets along with 176GB of more than half a million attachments, the data contained 2.4M unique email addresses, IP addresses names and photos. The data was predominantly support tickets seeking help to install the spyware on target devices, whilst the attachments contained various data including screen grans of financial transactions, photos of credit cards and nude selfies.
Muah.AI (muah.ai)
Breach date: 2024-09-17
Accounts affected: 1910261
Data exposed: AI prompts, Email addresses, Sexual fetishes
In September 2024, the "AI girlfriend" website Muah.AI suffered a data breach. The breach exposed 1.9M email addresses alongside prompts to generate AI-based images. Many of the prompts were highly sexual in nature, with many also describing child exploitation scenarios.
Multiplayer.it (multiplayer.it)
Breach date: 2018-09-01
Accounts affected: 503957
Data exposed: Email addresses, Passwords
In April 2024, over half a million records taken from the Italian gaming website Multiplayer.it were posted to a popular hacking forum. The impacted data included email addresses, usernames and salted MD5 password hashes. Multiplayer.it subsequently confirmed the breach dated back 6 years to September 2018 and was merely re-posted in 2024.