Tiago2024180/eyewebdataset huggingface dataset:
VimeWorld (vimeworld.com)
Breach date: 2018-10-01
Accounts affected: 3118964
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In October 2018, the Russian Minecraft service VimeWorld suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 3.1M records of usernames, email and IP addresses and passwords stored as either MD5 or bcrypt hashes.
Viva Air (vivaair.com)
Breach date: 2022-03-14
Accounts affected: 932232
Data exposed: Email addresses, IP addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases
In March 2022, the now defunct Colombian airline Viva Air suffered a data breach and subsequent ransomware attack. Among a trove of other ransomed data, the incident exposed a log of 2.6M transactions with 932k unique email addresses, physical and IP addresses, names, phone numbers and partial credit card data (last 4 digits).
VK (vk.com)
Breach date: 2012-01-01
Accounts affected: 93338602
Data exposed: Email addresses, Names, Passwords, Phone numbers
In approximately 2012, the Russian social media site known as VK was hacked and almost 100 million accounts were exposed. The data emerged in June 2016 where it was being sold via a dark market website and included names, phone numbers email addresses and plain text passwords.
VNG (zing.vn)
Breach date: 2015-05-19
Accounts affected: 24853850
Data exposed: Dates of birth, Email addresses, Genders, IP addresses, Marital statuses, Names, Occupations, Passwords, Phone numbers, Physical addresses, Usernames
In April 2018, news broke of a massive data breach impacting the Vietnamese company known as VNG after data was discovered being traded on a popular hacking forum where it was extensively redistributed. The breach dated back to an incident in May of 2015 and included of over 163 million customers. The data in the breach contained a wide range of personal attributes including usernames, birth dates, genders and home addresses along with unsalted MD5 hashes and 25 million unique email addresses. The data was provided to HIBP by dehashed.com.
Vodafone (vodafone.is)
Breach date: 2013-11-30
Accounts affected: 56021
Data exposed: Credit cards, Email addresses, Government issued IDs, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Purchases, SMS messages, Usernames
In November 2013, Vodafone in Iceland suffered an attack attributed to the Turkish hacker collective "Maxn3y". The data was consequently publicly exposed and included user names, email addresses, social security numbers, SMS message, server logs and passwords from a variety of different internal sources.
Void.to (void.to)
Breach date: 2019-06-13
Accounts affected: 95431
Data exposed: Email addresses, IP addresses, Passwords, Private messages, Usernames
In June 2019, the hacking website Void.to suffered a data breach. There were 95k unique email addresses spread across 86k forum users and other tables in the database. A rival hacking website claimed responsibility for breaching the MyBB based forum which disclosed email and IP addresses, usernames, private messages and passwords stored as either salted MD5 or bcrypt hashes.
VTech (vtechda.com)
Breach date: 2015-11-13
Accounts affected: 4833678
Data exposed: Dates of birth, Email addresses, Family members' names, Genders, IP addresses, Names, Passwords, Physical addresses, Security questions and answers, Usernames, Website activity
In November 2015, hackers extracted more than 4.8 million parents' and 227k children's accounts from VTech's Learning Lodge website. The Hong Kong company produces learning products for children including software sold via the compromised website. The data breach exposed extensive personal details including home addresses, security questions and answers and passwords stored as weak MD5 hashes. Furthermore, children's details including names, ages, genders and associations to their parents' records were also exposed.
V-Tight Gel (vtightgel.com)
Breach date: 2016-02-13
Accounts affected: 2013164
Data exposed: Email addresses, IP addresses, Names, Phone numbers, Physical addresses
In approximately February 2016, data surfaced which was allegedly obtained from V-Tight Gel (vaginal tightening gel). Whilst the data set was titled V-Tight, within there were 50 other (predominantly wellness-related) domain names, most owned by the same entity. Multiple HIBP subscribers confirmed that although they couldn't recall providing data specifically to V-Tight, their personal information including name, phone and physical address was accurate. V-Tight Gel did not reply to multiple requests for comment.
Vultr (vultr.com)
Breach date: 2022-07-08
Accounts affected: 187872
Data exposed: Email addresses, Geographic locations, IP addresses, Names
In March 2023, the "AI-first global cloud platform" Vultr disclosed a security incident at a third-party vendor. Dating back to the previous year, the incident was attributed to the ActiveCampaign email marketing service provider and resulted in the exposure of 188k unique email addresses. A small number of records also included name, IP address and country of origin. No Vultr systems or additional customer data were impacted. Vultr subsequently self-submitted the impacted data to HIBP.
Wakanim (wakanim.tv)
Breach date: 2022-08-28
Accounts affected: 6706951
Data exposed: Browser user agent details, Email addresses, IP addresses, Names, Physical addresses, Usernames
In August 2022, the European streaming service Wakanim suffered a data breach which was subsequently advertised and sold on a popular hacking forum. The breach exposed 6.7M customer records including email, IP and physical addresses, names and usernames.
Wanelo (wanelo.com)
Breach date: 2018-12-13
Accounts affected: 23165793
Data exposed: Email addresses, IP addresses, Names, Passwords, Physical addresses
In approximately December 2018, the digital mall Wanelo suffered a data breach. The data was later placed up for sale on a dark web marketplace along with a collection of other data breaches in April 2019. A total of 23 million unique email addresses were included in the breach alongside passwords stored as either MD5 or bcrypt hashes. After the initial HIBP load, further data containing names, shipping addresses and IP addresses were also provided to HIBP, albeit without direct association to the email addresses and passwords.
War Inc. (thewarinc.com)
Breach date: 2012-07-04
Accounts affected: 1020136
Data exposed: Email addresses, Passwords, Usernames, Website activity
In mid-2012, the real-time strategy game War Inc. suffered a data breach. The attack resulted in the exposure of over 1 million accounts including usernames, email addresses and salted MD5 hashes of passwords.
Warframe (warframe.com)
Breach date: 2014-11-24
Accounts affected: 819478
Data exposed: Email addresses, Usernames, Website activity
In November 2014, the online game Warframe was hacked and 819k unique email addresses were exposed. Allegedly due to a SQL injection flaw in Drupal, the attack exposed usernames, email addresses and data in a "pass" column which adheres to the salted SHA12 password hashing pattern used by Drupal 7. Digital Extremes (the developers of Warframe), asserts the salted hashes are of "alias names" rather than passwords.
Warmane (warmane.com)
Breach date: 2016-12-01
Accounts affected: 1116256
Data exposed: Dates of birth, Email addresses, Passwords, Usernames
In approximately December 2016, the online service for World of Warcraft private servers Warmane suffered a data breach. The incident exposed over 1.1M accounts including usernames, email addresses, dates of birth and salted MD5 password hashes. The data was subsequently extensively circulated online and was later provided to HIBP by whitehat security researcher and data analyst Adam Davies.
Washington State Food Worker Card (foodworkercard.wa.gov)
Breach date: 2022-11-17
Accounts affected: 1594305
Data exposed: Dates of birth, Driver's licenses, Email addresses, Geographic locations, Names
In June 2023, the Tacoma-Pierce County Health Department announced a data breach of their Washington State Food Worker Card online training system. The breach was published to a popular hacking forum the year before and dated back to a 2018 database backup. Included in the data were 1.6M unique email addresses along with names, post codes, dates of birth and approximately 9.5k driver's licence numbers.
Wattpad (wattpad.com)
Breach date: 2020-06-29
Accounts affected: 268765495
Data exposed: Bios, Dates of birth, Email addresses, Genders, Geographic locations, IP addresses, Names, Passwords, Social media profiles, User website URLs, Usernames
In June 2020, the user-generated stories website Wattpad suffered a huge data breach that exposed almost 270 million records. The data was initially sold then published on a public hacking forum where it was broadly shared. The incident exposed extensive personal information including names and usernames, email and IP addresses, genders, birth dates and passwords stored as bcrypt hashes.
We Heart It (weheartit.com)
Breach date: 2013-11-03
Accounts affected: 8600635
Data exposed: Email addresses, Passwords, Usernames
In November 2013, the image-based social network We Heart It suffered a data breach. The incident wasn't discovered until October 2017 when 8.6 million user records were sent to HIBP. The data contained user names, email addresses and password hashes, 80% of which were salted SHA-256 with the remainder being MD5 with no salt.
Web Hosting Talk (webhostingtalk.com)
Breach date: 2016-07-01
Accounts affected: 515149
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In July 2016, the Web Hosting Talk forum suffered a data breach that was subsequently listed for sale. The breach of the vBulletin based forum exposed 515k user records including usernames, email addresses, IP addresses and salted MD5 password hashes.
WedMeGood (wedmegood.com)
Breach date: 2021-01-06
Accounts affected: 1306723
Data exposed: Email addresses, Genders, Names, Passwords, Phone numbers, Physical addresses
In January 2021, the Indian wedding planning platform WedMeGood suffered a data breach that exposed 1.3 million customers. The breach exposed 41.5GB of data including email and physical addresses, names, genders, phone numbers and password hashes. The data was provided to HIBP by dehashed.com.
Weee (sayweee.com)
Breach date: 2022-07-11
Accounts affected: 1117405
Data exposed: Delivery instructions, Email addresses, Names, Phone numbers, Purchases
In February 2023, data belonging to the Asian and Hispanic food delivery service Weee appeared on a popular hacking forum. Dating back to mid-2022, the data included 1.1M unique email addresses from 11M rows of orders containing names, phone numbers and delivery instructions.
WeLeakInfo (weleakinfo.com)
Breach date: 2021-03-08
Accounts affected: 11788
Data exposed: Browser user agent details, Email addresses, Employers, IP addresses, Names, Partial credit card data, Physical addresses, Purchases
In March 2021, the Stripe account of the now-defunct WeLeakInfo service was taken over by "pompompurin" after acquiring an expired domain name with an email address used to manage the account. Access to Stripe then exposed almost 12k unique email addresses from customers who'd made credit card payments in order to obtain breached data hosted by WeLeakInfo. The data was subsequently leaked publicly and also included names, payment histories, IP addresses, billing addresses, partial credit card data and the organisation making the purchase.
Welhof (welhof.com)
Breach date: 2023-12-01
Accounts affected: 107292
Data exposed: Email addresses, Names, Physical addresses, Purchases
In late 2023, the Dutch appliance store Welhof suffered a data breach. The incident exposed over 100k unique email addresses along with names, physical addresses and the value of purchases made.
Wendy's (wendys.com.ph)
Breach date: 2018-03-31
Accounts affected: 52485
Data exposed: Education levels, Email addresses, IP addresses, Job applications, Names, Passwords, Phone numbers, Physical addresses
In March 2018, Wendy's in the Philippines suffered a data breach which impacted over 52k customers and job applicants. The breach exposed extensive personal information including names, email and IP addresses, physical addresses, phone numbers and passwords stored as MD5 hashes.
WhiteDate (whitedate.net)
Breach date: 2025-12-29
Accounts affected: 20363
Data exposed: Ages, Astrological signs, Bios, Device information, Education levels, Email addresses, Family structure, Forum posts, Genders, Geographic locations, Income levels, IP addresses, IQ levels, Nicknames, Passwords, Physical attributes, Private messages, Profile photos, Races, Relationship statuses, Sexual orientations, Usernames
In December 2025, the dating website "for a Europid vision" WhiteDate suffered a data breach that was subsequently leaked online, initially exposing 6.1k unique email addresses. The leaked data included extensive personal information such as physical appearance, income, education and IQ. A more comprehensive dataset was later provided to HIBP, containing usernames, IP addresses, private messages, phpBB password hashes and a total of 20k unique email addresses.
Whitepages (whitepages.com)
Breach date: 2016-06-27
Accounts affected: 11657763
Data exposed: Email addresses, Names, Passwords
In mid-2016, the telephone and address directory service Whitepages was among a raft of sites that were breached and their data then sold in early-2019. The data included over 11 million unique email addresses alongside names and passwords stored as either a SHA-1 or bcrypt hash.
WHMCS (whmcs.com)
Breach date: 2012-05-21
Accounts affected: 134047
Data exposed: Email addresses, Email messages, Employers, IP addresses, Names, Partial credit card data, Passwords, Payment histories, Physical addresses, Website activity
In May 2012, the web hosting, billing and automation company WHMCS suffered a data breach that exposed 134k email addresses. The breach included extensive information about customers and payment histories including partial credit card numbers.
Wiener Büchereien ()
Breach date: 2019-06-10
Accounts affected: 224119
Data exposed: Dates of birth, Email addresses, Names, Phone numbers, Physical addresses
In June 2019, the library of Vienna (Wiener Büchereien) suffered a data breach. The compromised data included 224k unique email addresses, names, physical addresses, phone numbers and dates of birth. The breached data was subsequently posted to Twitter by the alleged perpetrator of the breach.
Wife Lovers (wifelovers.com)
Breach date: 2018-10-07
Accounts affected: 1274051
Data exposed: Email addresses, IP addresses, Names, Passwords, Usernames
In October 2018, the site dedicated to posting naked photos and other erotica of wives Wife Lovers suffered a data breach. The underlying database supported a total of 8 different adult websites and contained over 1.2M unique email addresses. Wife Lovers acknowledged the breach which impacted names, usernames, email and IP addresses and passwords hashed using the weak DEScrypt algorithm. The breach has been marked as "sensitive" due to the nature of the site.
WIIU ISO (wiiuiso.com)
Breach date: 2015-09-25
Accounts affected: 458155
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In September 2015, the Nintendo Wii U forum known as WIIU ISO was hacked and 458k accounts were exposed. Along with email and IP addresses, the vBulletin forum also exposed salted MD5 password hashes.
WildStar (wildstar-online.com)
Breach date: 2015-07-11
Accounts affected: 738556
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames
In July 2015, the IP.Board forum for the gaming website WildStar suffered a data breach that exposed over 738k forum members' accounts. The data was being actively traded on underground forums and included email addresses, birth dates and passwords.
Win7Vista Forum (win7vista.com)
Breach date: 2013-09-03
Accounts affected: 202683
Data exposed: Email addresses, Instant messenger identities, IP addresses, Names, Passwords, Private messages, Usernames, Website activity
In September 2013, the Win7Vista Windows forum (since renamed to the "Beyond Windows 9" forum) was hacked and later had its internal database dumped. The dump included over 200k members’ personal information and other internal data extracted from the forum.
WIRED (wired.com)
Breach date: 2025-09-08
Accounts affected: 2364431
Data exposed: Dates of birth, Display names, Email addresses, Genders, Geographic locations, Names, Phone numbers, Physical addresses
In December 2025, 2.3M records of WIRED magazine users allegedly obtained from parent company Condé Nast were published online. The most recent data dated back to the previous September and exposed email addresses and display names, as well as, for a small number of users, their name, phone number, date of birth, gender, and geographic location or full physical address. The WIRED data allegedly represents a subset of Condé Nast brands the hacker also claims to have obtained.
WiredBucks (wiredbucks.com)
Breach date: 2022-05-25
Accounts affected: 918529
Data exposed: Earnings, Email addresses, IP addresses, Names, Passwords, Physical addresses, Usernames
In May 2022, the now defunct social media influencer platform WiredBucks suffered a data breach that was later redistributed as part of a larger corpus of data. The incident exposed over 900k email and IP addresses alongside names, usernames, earnings via the platform, physical addresses and passwords stored as plain text.
Wishbone (2016) (wishbone.io)
Breach date: 2016-08-07
Accounts affected: 2247314
Data exposed: Auth tokens, Dates of birth, Email addresses, Genders, Names, Phone numbers, Usernames
In August 2016, the mobile app to "compare anything" known as Wishbone suffered a data breach. The data contained 9.4 million records with 2.2 million unique email addresses and was allegedly a subset of the complete data set. The exposed data included genders, birthdates, email addresses and phone numbers for an audience predominantly composed of teenagers and young adults.
Wishbone (2020) (wishbone.io)
Breach date: 2020-01-27
Accounts affected: 9705172
Data exposed: Auth tokens, Dates of birth, Email addresses, Genders, Geographic locations, IP addresses, Names, Passwords, Phone numbers, Profile photos, Social media profiles, Usernames
In January 2020, the mobile app to "compare anything" Wishbone suffered another data breach which followed their breach from 2016. An extensive amount of personal information including almost 10M unique email addresses alongside names, phone numbers geographic locations and other personal attributes were leaked online and extensively redistributed. Passwords stored as unsalted MD5 hashes were also included in the breach.
WiziShop (wizishop.fr)
Breach date: 2020-07-14
Accounts affected: 2856769
Data exposed: Dates of birth, Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses
In July 2020, the French e-commerce platform WiziShop suffered a data breach. The breach exposed 18GB worth of data including names, phone numbers, dates of birth, physical and IP addresses, SHA-1 password hashes and almost 3 million unique email addresses.
Wongnai (wongnai.com)
Breach date: 2020-10-28
Accounts affected: 3924454
Data exposed: Dates of birth, Email addresses, Geographic locations, IP addresses, Names, Passwords, Phone numbers, Social media profiles
In October 2020, 17 previously undisclosed data breaches appeared for sale including the Thai restaurant, hotel and attraction finding service, Wongnai. The breach exposed almost 4M unique customer records from some time during 2020 along with names, phone numbers, links to social media profiles and passwords stored as MD5 hashes. The data was self-submitted to HIBP by Wongnai.
WoTLabs (wotlabs.net)
Breach date: 2024-03-03
Accounts affected: 21994
Data exposed: Dates of birth, Email addresses, IP addresses, Time zones, Usernames
In March 2024, WoTLabs (World of Tanks Statistics and Resources) suffered a data breach and website defacement attributed to "chromebook breachers". The breach exposed 22k forum members' personal data including email and IP addresses, usernames, dates of birth and time zones.
WPSandbox (wpsandbox.io)
Breach date: 2018-11-04
Accounts affected: 858
Data exposed: Email addresses, Passwords
In November 2018, the WordPress sandboxing service that allows people to create temporary websites WP Sandbox discovered their service was being used to host a phishing site attempting to collect Microsoft OneDrive accounts. After identifying the malicious site, WP Sandbox took it offline, contacted the 858 people who provided information to it then self-submitted their addresses to HIBP. The phishing page requested both email addresses and passwords.
WPT Amateur Poker League (wptapl.com)
Breach date: 2014-01-04
Accounts affected: 148366
Data exposed: Email addresses, Passwords
In January 2014, the World Poker Tour (WPT) Amateur Poker League website was hacked by the Twitter user @smitt3nz. The attack resulted in the public disclosure of 175,000 accounts including 148,000 email addresses. The plain text password for each account was also included in the breach.
xat (xat.com)
Breach date: 2015-11-04
Accounts affected: 5968783
Data exposed: Email addresses, IP addresses, Passwords, Usernames, Website activity
In November 2015, the online chatroom known as "xat" was hacked and 6 million user accounts were exposed. Used as a chat engine on websites, the leaked data included usernames, email and IP addresses along with hashed passwords.
Xbox 360 ISO (xbox360iso.com)
Breach date: 2015-09-25
Accounts affected: 1296959
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In approximately September 2015, the XBOX 360 forum known as XBOX360 ISO was hacked and 1.2 million accounts were exposed. Along with email and IP addresses, the vBulletin forum also exposed salted MD5 password hashes.
Xbox-Scene (xboxscene.com)
Breach date: 2015-02-01
Accounts affected: 432552
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In approximately February 2015, the Xbox forum known as Xbox-Scene was hacked and more than 432k accounts were exposed. The IP.Board forum included IP addresses and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked.
xHamster (xhamster.com)
Breach date: 2016-11-28
Accounts affected: 377377
Data exposed: Email addresses, Passwords, Usernames
In November 2016, news broke that hackers were trading hundreds of thousands of xHamster porn account details. In total, the data contained almost 380k unique user records including email addresses, usernames and unsalted MD5 password hashes.
Xiaomi (xiaomi.cn)
Breach date: 2012-08-01
Accounts affected: 7088010
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In August 2012, the Xiaomi user forum website suffered a data breach. In all, 7 million email addresses appeared in the breach although a significant portion of them were numeric aliases on the bbs_ml_as_uid.xiaomi.com domain. Usernames, IP addresses and passwords stored as salted MD5 hashes were also exposed. The data was provided with support from dehashed.com. Read more about Chinese data breaches in Have I Been Pwned.
XKCD (xkcd.com)
Breach date: 2019-07-01
Accounts affected: 561991
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In July 2019, the forum for webcomic XKCD suffered a data breach that impacted 562k subscribers. The breached phpBB forum leaked usernames, email and IP addresses and passwords stored in MD5 phpBB3 format. The data was provided to HIBP by white hat security researcher and data analyst Adam Davies.