Tiago2024180/eyewebdataset huggingface dataset:
000webhost (000webhost.com)
Breach date: 2015-03-01
Accounts affected: 14936670
Data exposed: Email addresses, IP addresses, Names, Passwords
In approximately March 2015, the free web hosting provider 000webhost suffered a major data breach that exposed almost 15 million customer records. The data was sold and traded before 000webhost was alerted in October. The breach included names, email addresses and plain text passwords.
123RF (123rf.com)
Breach date: 2020-03-22
Accounts affected: 8661578
Data exposed: Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
In March 2020, the stock photo site 123RF suffered a data breach which impacted over 8 million subscribers and was subsequently sold online. The breach included email, IP and physical addresses, names, phone numbers and passwords stored as MD5 hashes. The data was provided to HIBP by dehashed.com.
126 (126.com)
Breach date: 2012-01-01
Accounts affected: 6414191
Data exposed: Email addresses, Passwords
In approximately 2012, it's alleged that the Chinese email service known as 126 suffered a data breach that impacted 6.4 million subscribers. Whilst there is evidence that the data is legitimate, due to the difficulty of emphatically verifying the Chinese breach it has been flagged as "unverified". The data in the breach contains email addresses and plain text passwords. Read more about Chinese data breaches in Have I Been Pwned.
17 (17app.co)
Breach date: 2016-04-19
Accounts affected: 4009640
Data exposed: Device information, Email addresses, IP addresses, Passwords, Usernames
In April 2016, customer data obtained from the streaming app known as "17" appeared listed for sale on a Tor hidden service marketplace. The data contained over 4 million unique email addresses along with IP addresses, usernames and passwords stored as unsalted MD5 hashes.
17173 (17173.com)
Breach date: 2011-12-28
Accounts affected: 7485802
Data exposed: Email addresses, Passwords, Usernames
In late 2011, a series of data breaches in China affected up to 100 million users, including 7.5 million from the gaming site known as 17173. Whilst there is evidence that the data is legitimate, due to the difficulty of emphatically verifying the Chinese breach it has been flagged as "unverified". The data in the breach contains usernames, email addresses and salted MD5 password hashes and was provided with support from dehashed.com. Read more about Chinese data breaches in Have I Been Pwned.
1win (1win.com)
Breach date: 2024-11-02
Accounts affected: 96166543
Data exposed: Dates of birth, Email addresses, Geographic locations, IP addresses, Passwords, Phone numbers
In November 2024, the online betting platform 1win suffered a data breach that exposed 96M users. The exposed data included email and IP addresses, phone numbers, dates of birth, country and SHA-256 password hashes.
2,844 Separate Data Breaches ()
Breach date: 2018-02-19
Accounts affected: 80115532
Data exposed: Email addresses, Passwords
In February 2018, a massive collection of almost 3,000 alleged data breaches was found online. Whilst some of the data had previously been seen in Have I Been Pwned, 2,844 of the files consisting of more than 80 million unique email addresses had not previously been seen. Each file contained both an email address and plain text password and were consequently loaded as a single "unverified" data breach.
2fast4u (2fast4u.be)
Breach date: 2017-12-20
Accounts affected: 17706
Data exposed: Email addresses, Passwords, Usernames
In December 2017, the Belgian motorcycle forum 2fast4u discovered a data breach of their system. The breach of the vBulletin message board impacted over 17k individual users and exposed email addresses, usersnames and salted MD5 passwords.
500px (500px.com)
Breach date: 2018-07-05
Accounts affected: 14867999
Data exposed: Dates of birth, Email addresses, Genders, Geographic locations, Names, Passwords, Usernames
In mid-2018, the online photography community 500px suffered a data breach. The incident exposed almost 15 million unique email addresses alongside names, usernames, genders, dates of birth and either an MD5 or bcrypt password hash. In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly.
7k7k (7k7k.com)
Breach date: 2011-01-01
Accounts affected: 9121434
Data exposed: Email addresses, Passwords, Usernames
In approximately 2011, it's alleged that the Chinese gaming site known as 7k7k suffered a data breach that impacted 9.1 million subscribers. Whilst there is evidence that the data is legitimate, due to the difficulty of emphatically verifying the Chinese breach it has been flagged as "unverified". The data in the breach contains usernames, email addresses and plain text passwords. Read more about Chinese data breaches in Have I Been Pwned.
8fit (8fit.com)
Breach date: 2018-07-01
Accounts affected: 15025407
Data exposed: Email addresses, Genders, Geographic locations, IP addresses, Names, Passwords
In July 2018, the health and fitness service 8fit suffered a data breach. The data subsequently appeared for sale on a dark web marketplace in February 2019 and included over 15M unique email addresses alongside names, genders, IP addresses and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
8tracks (8tracks.com)
Breach date: 2017-06-27
Accounts affected: 17979961
Data exposed: Email addresses, Passwords
In June 2017, the online playlists service known as 8Tracks suffered a data breach which impacted 18 million accounts. In their disclosure, 8Tracks advised that "the vector for the attack was an employee’s GitHub account, which was not secured using two-factor authentication". Salted SHA-1 password hashes for users who didn't sign up with either Google or Facebook authentication were also included. The data was provided to HIBP by whitehat security researcher and data analyst Adam Davies and contained almost 8 million unique email addresses. The complete set of 18M records was later provided by JimScott.Sec@protonmail.com and updated in HIBP accordingly.
9Lives (9lives.be)
Breach date: 2014-10-01
Accounts affected: 109515
Data exposed: Email addresses, Passwords, Usernames
In October 2014, the (now defunct) Belgian gaming news forum 9Lives suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed 109k unique email addresses along with usernames and salted MD5 password hashes.
Abandonia (2015) (abandonia.com)
Breach date: 2015-11-01
Accounts affected: 776125
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In November 2015, the gaming website dedicated to classic DOS games Abandonia suffered a data breach resulting in the exposure of 776k unique user records. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords.
Abandonia (2022) (abandonia.com)
Breach date: 2022-11-15
Accounts affected: 919790
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In November 2022, the gaming website dedicated to classic DOS games Abandonia suffered a data breach resulting in the exposure of 920k unique user records. This breach was in addition to another one 7 years earlier in 2015. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords.
AbuseWith.Us (abusewith.us)
Breach date: 2016-07-01
Accounts affected: 1372550
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In 2016, the site dedicated to helping people hack email and online gaming accounts known as Abusewith.us suffered multiple data breaches. The site allegedly had an administrator in common with the nefarious LeakedSource site, both of which have since been shut down. The exposed data included more than 1.3 million unique email addresses, often accompanied by usernames, IP addresses and plain text or hashed passwords retrieved from various sources and intended to be used to compromise the victims' accounts.
Acne.org (acne.org)
Breach date: 2014-11-25
Accounts affected: 432943
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames
In November 2014, the acne website acne.org suffered a data breach that exposed over 430k forum members' accounts. The data was being actively traded on underground forums and included email addresses, birth dates and passwords.
Activision (activision.com)
Breach date: 2022-12-04
Accounts affected: 16006
Data exposed: Email addresses, Geographic locations, Job titles, Names, Phone numbers
In December 2022, attackers socially engineered an Activision HR employee into disclosing information which led to the breach of almost 20k employee records. The data contained 16k unique email addresses along with names, phone numbers, job titles and the office location of the employee. Activision advised that no sensitive employee information was included in the breach.
ActMobile (actmobile.com)
Breach date: 2021-10-08
Accounts affected: 1583193
Data exposed: Email addresses, IP addresses
In October 2021, security researcher Bob Diachenko discovered an exposed database he attributed to ActMobile, the operators of Dash VPN and FreeVPN. The exposed data included 1.6 million unique email addresses along with IP addresses and password hashes, all of which were subsequently leaked on a popular hacking forum. Although usage of the service was verified by HIBP subscribers, ActMobile denied the data was sourced from them and the breach has subsequently been flagged as "unverified".
Acuity ()
Breach date: 2020-06-18
Accounts affected: 14055729
Data exposed: Dates of birth, Email addresses, Genders, IP addresses, Names, Phone numbers, Physical addresses, Salutations
In mid-2020, a 437GB corpus of data attributed to an entity named "Acuity" was created and later extensively distributed. However, the source could not be confidently verified as any known companies named Acuity. The data totalled over 14M unique email addresses with each row containing extensive personal information across more than 400 columns of data including names, phone numbers, physical addresses, genders and dates of birth.
Adapt (adapt.io)
Breach date: 2018-11-05
Accounts affected: 9363740
Data exposed: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Social media profiles
In November 2018, security researcher Bob Diachenko identified an unprotected database hosted by data aggregator "Adapt". A provider of "Fresh Quality Contacts", the service exposed over 9.3M unique records of individuals and employer information including their names, employers, job titles, contact information and data relating to the employer including organisation description, size and revenue. No response was received from Adapt when contacted.
ADDA (adda.io)
Breach date: 2025-03-24
Accounts affected: 1829314
Data exposed: Email addresses, Names, Passwords, Phone numbers
In March 2025, data allegedly breached from the ADDA housing societies service was posted to a public hacking forum. The data contained over 1.8M unique email addresses along with names, phone numbers and MD5 password hashes.
Adecco (adecco.com)
Breach date: 2021-01-03
Accounts affected: 4284538
Data exposed: Email addresses, Genders, Geographic locations, Marital statuses, Names, Passwords, Phone numbers
In March 2021, news broke of a massive data breach impacting millions of Adecco customers in South America which was subsequently sold on a popular hacking forum. The breach exposed over 4M unique email addresses as well as genders, dates of birth, marital statuses, phone numbers and passwords stored as bcrypt hashes.
Aditya Birla Fashion and Retail (abfrl.com)
Breach date: 2021-12-01
Accounts affected: 5470063
Data exposed: Email addresses, Genders, Income levels, Job titles, Marital statuses, Names, Passwords, Phone numbers, Physical addresses, Purchases, Religions, Salutations
In December 2021, Indian retailer Aditya Birla Fashion and Retail Ltd was breached and ransomed. The ransom demand was allegedly rejected and data containing 5.4M unique email addresses was subsequently dumped publicly on a popular hacking forum the next month. The data contained extensive personal customer information including names, phone numbers, physical addresses, DoBs, order histories and passwords stored as MD5 hashes. Employee data was also dumped publicly and included salary grades, marital statuses and religions.
Adobe (adobe.com)
Breach date: 2013-10-04
Accounts affected: 152445165
Data exposed: Email addresses, Password hints, Passwords, Usernames
In October 2013, 153 million Adobe accounts were breached with each containing an internal ID, username, email, encrypted password and a password hint in plain text. The password cryptography was poorly done and many were quickly resolved back to plain text. The unencrypted hints also disclosed much about the passwords adding further to the risk that hundreds of millions of Adobe customers already faced.
Adopt Me Trading Values (adoptmetradingvalues.com)
Breach date: 2022-07-01
Accounts affected: 86136
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In July 2022, the Adopt Me Trading Values website for assessing the value of pet trades within the "Adopt Me!" Roblox game suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed 86k unique email addresses along with usernames (and Roblox usernames), IP addresses and bcrypt password hashes.
Adpost (adpost.com)
Breach date: 2025-02-14
Accounts affected: 3339512
Data exposed: Email addresses, Names, Usernames
In February 2025, data obtained from an earlier Adpost breach surfaced. The dataset contained 3.3M records including email addresses, usernames, and display names. Adpost later published a disclosure notice and advised they'd forced a credential refresh, among other actions.
Adult FriendFinder (2015) (adultfriendfinder.com)
Breach date: 2015-05-21
Accounts affected: 3867997
Data exposed: Dates of birth, Email addresses, Genders, Geographic locations, IP addresses, Races, Relationship statuses, Sexual orientations, Spoken languages, Usernames
In May 2015, the adult hookup site Adult FriendFinder was hacked and nearly 4 million records dumped publicly. The data dump included extremely sensitive personal information about individuals and their relationship statuses and sexual preferences combined with personally identifiable information.
Adult FriendFinder (2016) (adultfriendfinder.com)
Breach date: 2016-10-16
Accounts affected: 169746810
Data exposed: Email addresses, Passwords, Spoken languages, Usernames
In October 2016, the adult entertainment company Friend Finder Networks suffered a massive data breach. The incident impacted multiple separate online assets owned by the company, the largest of which was the Adult FriendFinder website alleged to be "the world's largest sex & swinger community". Exposed data included usernames, passwords stored as SHA-1 hashes and 170 million unique email addresses. This incident is separate to the 2015 data breach Adult FriendFinder also suffered. The data was provided to HIBP by dehashed.com.
Adult-FanFiction.Org (adult-fanfiction.org)
Breach date: 2018-05-30
Accounts affected: 186082
Data exposed: Dates of birth, Email addresses, Names, Passwords
In May 2018, the website for sharing adult-orientated works of fiction known as Adult-FanFiction.Org had 186k records exposed in a data breach. The data contained names, email addresses, dates of birth and passwords stored as both MD5 hashes and plain text. AFF did not respond when contacted about the breach and the site was previously reported as compromised on the Vigilante.pw breached database directory.
Advance Auto Parts (advanceautoparts.com)
Breach date: 2024-06-05
Accounts affected: 79243727
Data exposed: Email addresses, Names, Phone numbers, Physical addresses
In June 2024, Advance Auto Parts confirmed they had suffered a data breach which was posted for sale to a popular hacking forum. Linked to unauthorised access to Snowflake cloud services, the breach exposed a large number of records related to both customers and employees. In total, 79M unique email addresses were included in the breach, alongside names, phone numbers, addresses and further data attributes related to company employees.
AerServ (aerserv.com)
Breach date: 2018-04-01
Accounts affected: 66308
Data exposed: Email addresses, Employers, Job titles, Names, Passwords, Phone numbers, Physical addresses
In April 2018, the ad management platform known as AerServ suffered a data breach. Acquired by InMobi earlier in the year, the AerServ breach impacted over 66k unique email addresses and also included contact information and passwords stored as salted SHA-512 hashes. The data was publicly posted to Twitter later in 2018 after which InMobi was notified and advised they were aware of the incident.
AgusiQ-Torrents.pl (agusiq-torrents.pl)
Breach date: 2019-09-24
Accounts affected: 90478
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In September 2019, Polish torrent site AgusiQ-Torrents.pl suffered a data breach. The incident exposed 90k member records including email and IP addresses, usernames and passwords stored as MD5 hashes.
AhaShare.com (ahashare.com)
Breach date: 2013-05-30
Accounts affected: 180468
Data exposed: Email addresses, Genders, Geographic locations, IP addresses, Partial dates of birth, Passwords, Usernames, Website activity
In May 2013, the torrent site AhaShare.com suffered a breach which resulted in more than 180k user accounts being published publicly. The breach included a raft of personal information on registered users plus despite assertions of not distributing personally identifiable information, the site also leaked the IP addresses used by the registered identities.
ai.type (aitype.com)
Breach date: 2017-12-05
Accounts affected: 20580060
Data exposed: Address book contacts, Apps installed on devices, Cellular network names, Dates of birth, Device information, Email addresses, Genders, Geographic locations, IMEI numbers, IMSI numbers, IP addresses, Names, Phone numbers, Profile photos, Social media profiles
In December 2017, the virtual keyboard application ai.type was found to have left a huge amount of data publicly facing in an unsecured MongoDB instance. Discovered by researchers at The Kromtech Security Center, the 577GB data set included extensive personal information including over 20 million unique email addresses, social media profiles and address book contacts. The email addresses alone were provided to HIBP to enable impacted users to assess their exposure.
Aimware (aimware.net)
Breach date: 2019-04-28
Accounts affected: 305470
Data exposed: Email addresses, IP addresses, Passwords, Private messages, Usernames, Website activity
In mid-2019, the video game cheats website "Aimware" suffered a data breach that exposed hundreds of thousands of subscribers' personal information. Data included email and IP addresses, usernames, forum posts, private messages, website activity and passwords stored as salted MD5 hashes.
Aipai.com (aipai.com)
Breach date: 2016-09-27
Accounts affected: 6496778
Data exposed: Email addresses, Passwords
In September 2016, data allegedly obtained from the Chinese gaming website known as Aipai.com and containing 6.5M accounts was leaked online. Whilst there is evidence that the data is legitimate, due to the difficulty of emphatically verifying the Chinese breach it has been flagged as "unverified". The data in the breach contains email addresses and MD5 password hashes. Read more about Chinese data breaches in Have I Been Pwned.
Ajarn (ajarn.com)
Breach date: 2018-12-13
Accounts affected: 266399
Data exposed: Dates of birth, Education levels, Email addresses, Genders, Geographic locations, Job applications, Marital statuses, Names, Nationalities, Passwords, Phone numbers, Profile photos
In September 2021, the Thai-based English language teaching website Ajarn discovered they'd been the victim of a data breach dating back to December 2018. The breach was self-submitted to HIBP and included 266k email addresses, names, genders, phone numbers and other personal information. Hashed passwords were also impacted in the breach.
AKP Emails (akparti.org.tr)
Breach date: 2016-07-19
Accounts affected: 917461
Data exposed: Email addresses, Email messages
In July 2016, a hacker known as Phineas Fisher hacked Turkey's ruling party (Justice and Development Party or "AKP") and gained access to 300k emails. The full contents of the emails were subsequently published by WikiLeaks and made searchable. HIBP identified over 917k unique email address patterns in the data set, including message IDs and a number of other non-user addresses.
ALIEN TXTBASE Stealer Logs ()
Breach date: 2025-02-15
Accounts affected: 284132969
Data exposed: Email addresses, Passwords
In February 2025, 23 billion rows of stealer logs were obtained from a Telegram channel known as ALIEN TXTBASE. The data contained 284M unique email addresses alongside the websites they were entered into and the passwords used. This data is now searchable in HIBP by both email domain and the domain of the target website.
Allianz Life (allianzlife.com)
Breach date: 2025-07-16
Accounts affected: 1115061
Data exposed: Dates of birth, Email addresses, Genders, Names, Phone numbers, Physical addresses
In July 2025, Allianz Life was the victim of a cyber attack which resulted in millions of records later being leaked online. Allianz attributed the attack to "a social engineering technique" which targeted data on Salesforce and resulted in the exposure of 1.1M unique email addresses, names, genders, dates of birth, phone numbers and physical addresses.
AlpineReplay (traceup.com)
Breach date: 2019-08-27
Accounts affected: 898681
Data exposed: Dates of birth, Email addresses, Genders, Names, Passwords, Physical attributes, Usernames
In 2019, the snow sports tracking app AlpineReplay suffered a data breach that exposed 900k unique email addresses. Later rolled into the Trace service, the breach included names, usernames, genders, dates of birth, weights and passwords stored as either unsalted MD5 or bcrypt hashes.
Altenen (altenens.is)
Breach date: 2022-06-24
Accounts affected: 1267701
Data exposed: Cryptocurrency wallet addresses, Email addresses, Passwords, Usernames
In June 2022, the malicious "carding" (referring to credit card fraud) website Altenen suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 1.3M unique email addresses, usernames, bcrypt password hashes and cryptocurrency wallet addresses.
Amart Furniture (amartfurniture.com.au)
Breach date: 2022-05-16
Accounts affected: 108940
Data exposed: Email addresses, Names, Passwords, Phone numbers, Physical addresses
In May 2022, the Australian retailer Amart Furniture advised that their warranty claims database hosted on Amazon Web Services had been the target of a cyber attack. Over 100k records containing email and physical address, names, phone numbers and passwords stored as bcrypt hashes were exposed and shared online by the attacker.
Ancestry (ancestry.com)
Breach date: 2015-11-07
Accounts affected: 297806
Data exposed: Email addresses, Passwords
In November 2015, an Ancestry service known as RootsWeb suffered a data breach. The breach was not discovered until late 2017 when a file containing almost 300k email addresses and plain text passwords was identified.
Android Forums (androidforums.com)
Breach date: 2011-10-30
Accounts affected: 745355
Data exposed: Dates of birth, Email addresses, Homepage URLs, Instant messenger identities, IP addresses, Passwords
In October 2011, the Android Forums website was hacked and 745k user accounts were subsequently leaked publicly. The compromised data included email addresses, user birth dates and passwords stored as a salted MD5 hash.