Tiago2024180/eyewebdataset huggingface dataset:
Onverse (onverse.com)
Breach date: 2016-01-01
Accounts affected: 800157
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In January 2016, the online virtual world known as Onverse was hacked and 800k accounts were exposed. Along with email and IP addresses, the site also exposed salted MD5 password hashes.
Open CS:GO (opencsgo.com)
Breach date: 2017-11-28
Accounts affected: 512311
Data exposed: Avatars, Email addresses, IP addresses, Phone numbers, Physical addresses, Purchases, Social media profiles, Usernames
In December 2017, the website for purchasing Counter-Strike skins known as Open CS:GO (Counter-Strike: Global Offensive) suffered a data breach (address since redirects to dropgun.com). The 10GB file contained an extensive amount of personal information including email and IP addresses, phone numbers, physical addresses and purchase histories. Numerous attempts were made to contact Open CS:GO about the incident, however no responses were received.
Open Subtitles (opensubtitles.org)
Breach date: 2021-08-01
Accounts affected: 6783158
Data exposed: Email addresses, Geographic locations, IP addresses, Passwords, Usernames
In August 2021, the subtitling website Open Subtitles suffered a data breach and subsequent ransom demand. The breach exposed almost 7M subscribers' personal data including email and IP addresses, usernames, the country of the user and passwords stored as unsalted MD5 hashes.
Operation Endgame ()
Breach date: 2024-05-30
Accounts affected: 16466858
Data exposed: Email addresses, Passwords
In May 2024, a coalition of international law enforcement agencies took down a series of botnets in a campaign they coined "Operation Endgame". Data seized in the operation included impacted email addresses and passwords which were provided to HIBP to help victims learn of their exposure.
Operation Endgame 2.0 ()
Breach date: 2025-05-23
Accounts affected: 15436844
Data exposed: Email addresses, Passwords
In May 2025, a coalition of law enforcement agencies took down the criminal infrastructure behind the malware used to launch ransomware attacks in a new phase of "Operation Endgame". This followed the first Operation Endgame exercise a year earlier, with the latest action resulting in 15.3M victim email addresses being provided to HIBP by law enforcement. A further 43.8M victim passwords were also provided for HIBP's Pwned Passwords service.
Operation Endgame 3.0 ()
Breach date: 2025-11-13
Accounts affected: 2046030
Data exposed: Email addresses, Passwords
Between 10 and 13 November 2025, the latest phase of Operation Endgame was coordinated from Europol's headquarters in The Hague. The actions targeted one of the biggest infostealer Rhadamanthys, the Remote Access Trojan VenomRAT, and the botnet Elysium, all of which played a key role in international cybercrime. Authorities took down these three large cybercrime enablers and provided 2 million impacted email addresses and 7.4 million passwords to HIBP.
Orange Romania (orange.ro)
Breach date: 2025-02-24
Accounts affected: 556557
Data exposed: Email addresses, Partial credit card data, Phone numbers
In February 2025, the Romanian arm of telecommunications company Orange suffered a data breach which was subsequently published to a popular hacking forum. The data included 556k email addresses (of which hundreds of thousands were in the form of [phone number]@as1.romtelecom.net), phone numbers, subscription details, partial credit card data (type, last 4 digits, expiration date and issuing bank). The breach also exposed an extensive number of internal documents.
OrderSnapp (ordersnapp.com)
Breach date: 2020-06-29
Accounts affected: 1304447
Data exposed: Dates of birth, Email addresses, Names, Passwords, Phone numbers
In June 2020, the restaurant solutions provider OrderSnapp suffered a data breach which exposed 1.3M unique email addresses. Impacted data also included names, phone numbers, dates of birth and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
Ordine Avvocati di Roma (ordineavvocatiroma.it)
Breach date: 2019-05-07
Accounts affected: 41960
Data exposed: Email addresses, Email messages, Geographic locations, Passwords, Phone numbers
In May 2019, the Lawyers Order of Rome suffered a data breach by a group claiming to be Anonymous Italy. Data on tens of thousands of Roman lawyers was taken from the breached system and redistributed online. The data included contact information, email addresses and email messages themselves encompassing tens of thousands of unique email addresses. A total of 42k unique addresses appeared in the breach.
Otelier (otelier.com)
Breach date: 2024-07-01
Accounts affected: 436855
Data exposed: Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases, Travel plans
In July 2024, a threat actor gained access to the hotel management platform Otelier and retrieved customer data from well-known hotel brands including Marriott, Hilton, and Hyatt. The data included 437k customer email addresses (a further 868k generated email addresses from the booking.com and Expedia platforms were not loaded into HIBP), names, physical addresses, phone numbers, booking information related to travel plans, purchases recorded by the platform and in a small number of cases, partial credit card data.
OVH (ovh.com)
Breach date: 2015-05-01
Accounts affected: 452899
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In mid-2015, the forum for the hosting provider known as OVH suffered a data breach. The vBulletin forum contained 453k accounts including usernames, email and IP addresses and passwords stored as salted MD5 hashes.
OwnedCore (OwnedCore.com)
Breach date: 2013-08-01
Accounts affected: 880331
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In approximately August 2013, the World of Warcraft exploits forum known as OwnedCore was hacked and more than 880k accounts were exposed. The vBulletin forum included IP addresses and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked.
Oxfam (oxfam.org.au)
Breach date: 2021-01-20
Accounts affected: 1834006
Data exposed: Bank account numbers, Dates of birth, Email addresses, Genders, Names, Partial credit card data, Payment histories, Phone numbers, Physical addresses
In January 2021, Oxfam Australia was the victim of a data breach which exposed 1.8M unique email addresses of supporters of the charity. The data was put up for sale on a popular hacking forum and also included names, phone numbers, addresses, genders and dates of birth. A small number of people also had partial credit card data exposed (the first 6 and last 3 digits of the card, plus card type and expiry) and in some cases the bank name, account number and BSB were also exposed. The data was subsequently made freely available on the hacking forum later the following month.
Paddy Power (paddypower.com)
Breach date: 2010-10-25
Accounts affected: 590954
Data exposed: Account balances, Dates of birth, Email addresses, IP addresses, Names, Phone numbers, Physical addresses, Security questions and answers, Usernames, Website activity
In October 2010, the Irish bookmaker Paddy Power suffered a data breach that exposed 750,000 customer records with nearly 600,000 unique email addresses. The breach was not disclosed until July 2014 and contained extensive personal information including names, addresses, phone numbers and plain text security questions and answers.
Pampling (pampling.com)
Breach date: 2020-01-04
Accounts affected: 383468
Data exposed: Email addresses, Names, Passwords, Usernames
In January 2020, the online clothing retailer Pampling suffered a data breach that exposed 383k unique customer email addresses. The data was later shared on a popular hacking forum and also included names, usernames and unsalted MD5 password hashes.
Pandabuy (pandabuy.com)
Breach date: 2024-03-31
Accounts affected: 1348407
Data exposed: Email addresses, IP addresses, Names, Phone numbers, Physical addresses
In March 2024, 1.3M unique email addresses from the online store for purchasing goods from China, Pandabuy, were posted to a popular hacking forum. The data also included IP and physical addresses, names, phone numbers and order enquiries. The breach was alleged to be attributed to "Sanggiero" and "IntelBroker".
Panera Bread (panerabread.com)
Breach date: 2026-01-07
Accounts affected: 5112502
Data exposed: Email addresses, Names, Phone numbers, Physical addresses
In January 2026, Panera Bread suffered a data breach that exposed 14M records. After an attempted extortion failed, the attackers published the data publicly, which included 5.1M unique email addresses along with associated account information such as names, phone numbers and physical addresses. Panera Bread subsequently confirmed that "the data involved is contact information" and that authorities were notified.
Paragon Cheats (paragoncheats.com)
Breach date: 2021-05-22
Accounts affected: 188089
Data exposed: Browser user agent details, Email addresses, IP addresses, Usernames
In May 2021, the Grand Theft Auto Online cheats website Paragon Cheats suffered a data breach that lead to the shutdown of the service. The breach exposed 188k customer records including usernames, email and IP addresses.
ParkMobile (parkmobile.io)
Breach date: 2021-03-21
Accounts affected: 20949825
Data exposed: Email addresses, Licence plates, Names, Passwords, Phone numbers
In March 2021, the mobile parking app service ParkMobile suffered a data breach which exposed 21 million customers' personal data. The impacted data included email addresses, names, phone numbers, vehicle licence plates and passwords stored as bcrypt hashes. The following month, the data appeared on a public hacking forum where it was extensively redistributed.
Pass'Sport (pass.sports.gouv.fr)
Breach date: 2025-12-17
Accounts affected: 6366133
Data exposed: Email addresses, Genders, Names, Phone numbers, Physical addresses
In December 2025, data from France's Pass'Sport program was posted to a popular hacking forum. Initially misattributed to CAF (the French family allowance fund), the data contained 6.5M unique email addresses affecting 3.5M households. The data also included names, phone numbers, genders and physical addresses. The Ministry of Sports subsequently released a statement acknowledging the incident.
Patreon (patreon.com)
Breach date: 2015-10-01
Accounts affected: 2330382
Data exposed: Email addresses, Passwords, Payment histories, Physical addresses, Private messages, Website activity
In October 2015, the crowdfunding site Patreon was hacked and over 16GB of data was released publicly. The dump included almost 14GB of database records with more than 2.3M unique email addresses, millions of personal messages and passwords stored as bcrypt hashes.
PayAsUGym (payasugym.com)
Breach date: 2016-12-15
Accounts affected: 400260
Data exposed: Browser user agent details, Email addresses, IP addresses, Names, Partial credit card data, Passwords, Phone numbers, Website activity
In December 2016, an attacker breached PayAsUGym's website exposing over 400k customers' personal data. The data was consequently leaked publicly and broadly distributed via Twitter. The leaked data contained personal information including email addresses and passwords hashed using MD5 without a salt.
PayHere (payhere.lk)
Breach date: 2022-03-27
Accounts affected: 1580249
Data exposed: Email addresses, IP addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases
In late March 2022, the Sri Lankan payment gateway PayHere suffered a data breach that exposed more than 65GB of payment records including over 1.5M unique email addresses. The data also included IP and physical addresses, names, phone numbers, purchase histories and partially obfuscated credit card data (card type, first 6 and last 4 digits plus expiry date). A month later, PayHere published a blog on the incident titled Ensuring Integrity on PayHere Cybersecurity Incident.
PaySystem.tech (paysystem.tech)
Breach date: 2022-04-29
Accounts affected: 1410764
Data exposed: Credit cards, Email addresses, Purchases
In mid-2022, data alleged to have been sourced from the Russian payment provider PaySystem.tech appeared in hacking circles where it was made publicly available for download. Consisting of 16M rows with 1.4M unique email addresses, the data also included purchases and full credit card numbers and expiry dates. The data could not be independently attributed back to PaySystem.tech and the breach has been flagged as "unverified".
Paytm (paytm.com)
Breach date: 2020-08-30
Accounts affected: 3395101
Data exposed: Dates of birth, Email addresses, Genders, Geographic locations, Income levels, Names, Phone numbers, Purchases
In August 2020, the Indian payment provider Paytm was reported as having suffered a data breach and subsequent ransom demand, after which the data was circulated publicly. Further investigation into the data concluded that the breach was fabricated and did not originate from Paytm. The impacted data covered 3.4M unique email addresses along with names, phone numbers, genders, dates of birth, income levels and previous purchases.
pcTattletale (pctattletale.com)
Breach date: 2024-05-25
Accounts affected: 138751
Data exposed: Device information, Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses, SMS messages, Usernames
In May 2024, the spyware service pcTattletale suffered a data breach that defaced the website and posted tens of gigabytes of data to the homepage, allegedly due to pcTattletale not responding to a previous security vulnerability report. The breach exposed data including membership records, infected PC names, captured messages and extensive logs of IP addresses and device information.
Peatix (peatix.com)
Breach date: 2019-01-20
Accounts affected: 4227907
Data exposed: Email addresses, Names, Passwords
In January 2019, the event organising platform Peatix suffered a data breach. The incident exposed 4.2M email addresses, names and salted password hashes. The data was provided to HIBP by dehashed.com.
Pemiblanc (pemiblanc.com)
Breach date: 2018-04-02
Accounts affected: 110964206
Data exposed: Email addresses, Passwords
In April 2018, a credential stuffing list containing 111 million email addresses and passwords known as Pemiblanc was discovered on a French server. The list contained email addresses and passwords collated from different data breaches and used to mount account takeover attacks against other services. Read more about the incident.
People's Energy (peoplesenergy.co.uk)
Breach date: 2020-12-16
Accounts affected: 358822
Data exposed: Dates of birth, Email addresses, Names, Passwords, Phone numbers, Physical addresses
In December 2020, the UK power company People's Energy suffered a data breach. The breach exposed almost 7GB of files containing 359k unique email addresses along with names, phones numbers, physical addresses and dates of birth. The incident also included People's Energy staff email addresses and bcrypt password hashes (no customer passwords were exposed).
PetFlow (petflow.com)
Breach date: 2017-12-09
Accounts affected: 990919
Data exposed: Email addresses, Passwords
In December 2017, the pet care delivery service PetFlow suffered a data breach which consequently appeared for sale on a dark web marketplace. Almost 1M accounts were impacted and exposed email addresses and passwords stored as unsalted MD5 hashes.
Phished Data via CERT Poland ()
Breach date: 2023-02-25
Accounts affected: 67943
Data exposed: Email addresses, Passwords
In August 2023, CERT Poland observed a phishing campaign that collected credentials from 68k victims. The campaign collected email addresses and passwords via a phishing email masquerading as a purchase order confirmation. CERT Poland identified a further 202 other phishing campaigns operating on the same C2 server, which has now been dismantled.
Phoenix (phoenixim.ddns.net)
Breach date: 2021-06-05
Accounts affected: 74776
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In mid-2021, the "vintage messaging reborn" service Phoenix suffered a data breach that exposed 75k unique email addresses. The breach also exposed IP addresses, usernames and passwords.
Phone House España (phonehouse.es)
Breach date: 2021-04-08
Accounts affected: 5223350
Data exposed: Dates of birth, Email addresses, Genders, Names, Nationalities, Phone numbers, Physical addresses
In April 2021, the Spanish retailer Phone House allegedly suffered a ransomware attack that also exposed significant volumes of customer data. Attributed to the Babuk ransomware, a collection of data alleged to be a subset of a larger corpus was posted to a dark web site and contained 5.2M email addresses along with names, nationalities, genders, dates of birth, phone numbers and physical addresses. Phone House has been threatened with further releases if a ransom is not paid.
PHP Freaks (phpfreaks.com)
Breach date: 2015-10-27
Accounts affected: 173891
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames, Website activity
In October 2015, the PHP discussion board PHP Freaks was hacked and 173k user accounts were publicly leaked. The breach included multiple personal data attributes as well as salted and hashed passwords.
Pi-hole (pi-hole.net)
Breach date: 2025-07-30
Accounts affected: 29926
Data exposed: Email addresses, Names
In July 2025, a vulnerability in the GiveWP WordPress plugin exposed the names and email addresses of approximately 30k donors to the Pi-hole network-wide ad blocking project. Pi-hole subsequently self-submitted the list of impacted donors to HIBP.
Piping Rock (pipingrock.com)
Breach date: 2024-04-24
Accounts affected: 2103100
Data exposed: Email addresses, Names, Phone numbers, Physical addresses
In April 2024, 2.1M email addresses from the online health products store Piping Rock were publicly posted to a popular hacking forum. The data also included names, phone numbers and physical addresses. The account posting the data had previously posted multiple other data breaches which all appear to have been obtained from the Shopify service used by the respective websites.
Pixel Federation (pixelfederation.com)
Breach date: 2013-12-04
Accounts affected: 38108
Data exposed: Email addresses, Passwords
In December 2013, a breach of the web-based game community based in Slovakia exposed over 38,000 accounts which were promptly posted online. The breach included email addresses and unsalted MD5 hashed passwords, many of which were easily converted back to plain text.
Pixlr (pixlr.com)
Breach date: 2020-10-07
Accounts affected: 1906808
Data exposed: Email addresses, Geographic locations, Names, Passwords, Social media profiles
In October 2020, the online photo editing application Pixlr suffered a data breach exposing 1.9 million subscribers. Impacted data included names, email addresses, social media profiles, the country signed up from and passwords stored as SHA-512 hashes. The data was provided to HIBP by dehashed.com.
piZap (pizap.com)
Breach date: 2017-12-07
Accounts affected: 41817893
Data exposed: Email addresses, Genders, Geographic locations, Names, Passwords, Social media profiles, Usernames, Website activity
In approximately December 2017, the online photo editing site piZap suffered a data breach. The data was later placed up for sale on a dark web marketplace along with a collection of other data breaches in February 2019. A total of 42 million unique email addresses were included in the breach alongside names, genders and links to Facebook profiles when the social media platform was used to authenticate to piZap. When accounts were created directly on piZap without using Facebook for authentication, passwords stored as SHA-1 hashes were also exposed.
Planet Calypso (planetcalypsoforum.com)
Breach date: 2019-07-01
Accounts affected: 62261
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In approximately July 2019, the forums for the Planet Calypso game suffered a data breach. The breach of the vBulletin based forum exposed email and IP addresses, usernames and passwords stored as salted MD5 hashes.
Planet Ice (planet-ice.co.uk)
Breach date: 2023-01-14
Accounts affected: 240488
Data exposed: Dates of birth, Email addresses, Genders, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Purchases
In January 2023, the UK-based ice skating rink booking service Planet Ice suffered a data breach. The incident exposed the personal data of 240k people including email and physical addresses, phone numbers, genders, dates of birth and passwords stored as MD5 hashes. The data also included the names, genders and dates of birth of children having parties.
Playbook (playbook.vc)
Breach date: 2020-10-19
Accounts affected: 50538
Data exposed: Email addresses, Job titles, Names, Passwords, Phone numbers, Social media profiles
In September 2021, a publicly accessible PostgresSQL database belonging to the Playbook service was identified. Run by VC firm Plug and Play Ventures, the database had been exposed since October 2020 and contained more than 50 thousand unique email addresses along with names, phone numbers, job titles and passwords stored as PBKDF2 hashes. It took more than 2 weeks after being notified of the exposed data to properly secure it. It's unknown whether Plug and Play Ventures notified impacted individuals as they ceased responding to queries from the press.
PlayCyberGames (playcybergames.com)
Breach date: 2023-08-09
Accounts affected: 3681753
Data exposed: Email addresses, Passwords, Usernames
In August 2023, PlayCyberGames which "allows users to play any games with LAN function or games using IP address" suffered a data breach which exposed 3.7M customer records. The data included email addresses, usernames and MD5 password hashes with a constant value in the "salt" field. PlayCyberGames did not respond to multiple attempts to disclose the breach.
Plex (plex.tv)
Breach date: 2015-07-02
Accounts affected: 327314
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In July 2015, the discussion forum for Plex media centre was hacked and over 327k accounts exposed. The IP.Board forum included IP addresses and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked.
Pluto TV (pluto.tv)
Breach date: 2018-10-12
Accounts affected: 3225080
Data exposed: Dates of birth, Device information, Email addresses, Genders, IP addresses, Names, Passwords, Social media profiles, Usernames
In October 2018, the internet television service Pluto TV suffered a data breach which was then shared extensively in hacking communities. Pluto TV "decided not to proactively inform users of the breach" which contained 3.2M unique email and IP addresses, names, usernames, genders, dates of birth and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
PoinCampus (poincampus.com)
Breach date: 2024-11-14
Accounts affected: 89116
Data exposed: Dates of birth, Email addresses, Names, Phone numbers
In November 2024, the South Korean education platform PoinCampus suffered a data breach which was later published to a popular hacking forum. The data included 89k unique email addresses, names and a small number of phone numbers and dates of birth.
Pokébip (pokebip.com)
Breach date: 2015-07-28
Accounts affected: 657001
Data exposed: Email addresses, IP addresses, Passwords, Time zones, Usernames, Website activity
In July 2015, the French Pokémon site Pokébip suffered a data breach which exposed 657k subscriber identities. The data included email and IP addresses, usernames and passwords stored as unsalted MD5 hashes.
Pokémon Creed (pokemoncreed.net)
Breach date: 2014-08-08
Accounts affected: 116465
Data exposed: Email addresses, Genders, IP addresses, Passwords, Usernames, Website activity
In August 2014, the Pokémon RPG website Pokémon Creed was hacked after a dispute with rival site, Pokémon Dusk. In a post on Facebook, "Cruz Dusk" announced the hack then pasted the dumped MySQL database on pkmndusk.in. The breached data included over 116k usernames, email addresses and plain text passwords.