Tiago2024180/eyewebdataset huggingface dataset:
Retina-X (retinax.com)
Breach date: 2017-02-23
Accounts affected: 71153
Data exposed: Email addresses, Passwords
In February 2017, the mobile device monitoring software developer Retina-X was hacked and customer data downloaded before being wiped from their servers. The incident was covered in the Motherboard article titled Inside the 'Stalkerware' Surveillance Market, Where Ordinary People Tap Each Other's Phones. The service, used to monitor mobile devices, had 71k email addresses and MD5 hashes with no salt exposed. Retina-X disclosed the incident in a blog post on April 27, 2017.
ReverbNation (reverbnation.com)
Breach date: 2014-01-01
Accounts affected: 7040725
Data exposed: Email addresses, Passwords
In January 2014, the online service for assisting musicians to build their careers ReverbNation suffered a data breach which wasn't identified until September the following year. The breach contained over 7 million accounts with unique email addresses and salted SHA1 passwords.
Rightbiz (rightdev.co.uk)
Breach date: 2023-07-09
Accounts affected: 65376
Data exposed: Email addresses, Names, Phone numbers, Physical addresses
In June 2023, data belonging to the "UK's No.1 Business Marketplace" Rightbiz appeared on a popular hacking forum. Comprising of more than 18M rows of data, the breach included 65k unique email addresses along with names, phone numbers and physical address. Rightbiz didn't respond to mulitple attempts to disclose the incident./a>.
River City Media Spam List (rivercitymediaonline.com)
Breach date: 2017-01-01
Accounts affected: 393430309
Data exposed: Email addresses, IP addresses, Names, Physical addresses
In January 2017, a massive trove of data from River City Media was found exposed online. The data was found to contain almost 1.4 billion records including email and IP addresses, names and physical addresses, all of which was used as part of an enormous spam operation. Once de-duplicated, there were 393 million unique email addresses within the exposed data.
Robinhood (robinhood.com)
Breach date: 2021-11-03
Accounts affected: 5003937
Data exposed: Email addresses
In November 2021, the online trading platform Robinhood suffered a data breach after a customer service representative was socially engineered. The incident exposed over 5M customer email addresses and 2M customer names.
Robinsons Malls (robinsonsmalls.com)
Breach date: 2024-06-01
Accounts affected: 195597
Data exposed: Dates of birth, Email addresses, Genders, Geographic locations, Names, Phone numbers
In June 2024, the Philippines' largest shopping-mall operators Robinsons Malls suffered a data breach stemming from their mobile app. The incident exposed 195k unique email addresses along with names, phone numbers, dates of birth, genders and the user's city and province.
Roblox (roblox.com)
Breach date: 2016-07-31
Accounts affected: 52458
Data exposed: Account balances, Email addresses, IP addresses, Purchases, Usernames
In August 2016, Roblox disclosed a data breach that affected over 50k users. The security incident impacted email and IP addresses, usernames, purchases and Robux balances which were left exposed on a test server.
Roblox Developer Conference (2023) (rdcglobal.com)
Breach date: 2020-12-18
Accounts affected: 3943
Data exposed: Clothing sizes, Dates of birth, Email addresses, IP addresses, Names, Phone numbers, Physical addresses, Usernames
In July 2023, a list of alleged attendees from the 2017-2020 Roblox Developers Conferences was circulated on a forum. The data contained 4k unique email addresses along with names, usernames, dates of birth, phone numbers, physical and IP addresses and T-shirt sizes
Roll20 (roll20.net)
Breach date: 2018-12-26
Accounts affected: 3994436
Data exposed: Email addresses, IP addresses, Names, Partial credit card data, Passwords
In December 2018, the tabletop role-playing games website Roll20 suffered a data breach. Almost 4 million customers were impacted by the breach and had email and IP addresses, names, bcrypt hashes of passwords and the last 4 digits of credit cards exposed.
Romwe (romwe.com)
Breach date: 2018-06-01
Accounts affected: 19531820
Data exposed: Geographic locations, IP addresses, Names, Passwords, Phone numbers, Physical addresses
In mid-2018, the Hong Kong-based retailer Romwe suffered a data breach which exposed almost 20 million customers. The data was subsequently sold online and includes names, phone numbers, email and IP addresses, customer geographic locations and passwords stored as salted SHA-1 hashes. The data was provided to HIBP by dehashed.com.
Rosebutt Board (rosebuttboard.com)
Breach date: 2016-05-09
Accounts affected: 107303
Data exposed: Email addresses, IP addresses, Passwords, Usernames
Some time prior to May 2016, the forum known as "Rosebutt Board" was hacked and 107k accounts were exposed. The self-described "top one board for anal fisting, prolapse, huge insertions and rosebutt fans" had email and IP addresses, usernames and weakly stored salted MD5 password hashes hacked from the IP.Board based forum.
Royal Enfield (royalenfield.com)
Breach date: 2019-01-01
Accounts affected: 420873
Data exposed: Dates of birth, Email addresses, Genders, Names, Passwords, Phone numbers, Physical addresses, Social media profiles, Vehicle details
In January 2020, motorcycle maker Royal Enfield left a database publicly exposed that resulted in the inadvertent publication of over 400k customers. The impacted data included email and physical addresses, names, motorcycle information, social media profiles, passwords, and other personal information.
RuneScape Boards (rsboards.com)
Breach date: 2011-12-26
Accounts affected: 222762
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In around 2011, the now defunct RuneScape Boards forum (also known as RSBoards) suffered a data breach that was later redistributed as part of a larger corpus of data. The vBulletin-based service exposed 223k unique email addresses along with usernames, IP addresses and salted MD5 password hashes.
Russian America (russianamerica.com)
Breach date: 2017-01-01
Accounts affected: 182717
Data exposed: Email addresses, Names, Passwords, Phone numbers
In approximately 2017, the website for Russian speakers in America known as Russian America suffered a data breach. The incident exposed 183k unique records including names, email addresses, phone numbers and passwords stored in both plain text and as MD5 hashes. Russian America was contacted about the breach but did not respond.
Salvadoran Citizens ()
Breach date: 2024-04-02
Accounts affected: 946989
Data exposed: Dates of birth, Email addresses, Government issued IDs, Names, Phone numbers, Physical addresses, Profile photos
In April 2024, nearly 6 million records of Salvadoran citizens were published to a popular hacking forum. The data included names, dates of birth, phone numbers, physical addresses and nearly 1M unique email addresses. Further, over 5M corresponding profile photos were also included in the breach.
Samsung Germany Customer Tickets (samsung.de)
Breach date: 2025-03-30
Accounts affected: 216333
Data exposed: Email addresses, Names, Physical addresses, Purchases, Salutations, Shipment tracking numbers, Support tickets
In March 2025, data from Samsung Germany was compromised in a data breach of their logistics provider, Spectos. Allegedly due to credentials being obtained by malware running on a Spectos employee's machine, the breach included 216k unique email addresses along with names, physical addresses, items purchased from Samsung Germany and related support tickets and shipping tracking numbers.
SaverSpy ()
Breach date: 2018-09-18
Accounts affected: 2457420
Data exposed: Email addresses, Genders, Names, Physical addresses
In September 2018, security researcher Bob Diachenko discovered a massive collection of personal details exposed in an unprotected Mongo DB instance. The data appears to have been used in marketing campaigns (possibly for spam purposes) but had little identifying data about it other than a description of "Yahoo_090618_ SaverSpy". The data set provided to HIBP had almost 2.5M unique email addresses (all of which were from Yahoo!) alongside names, genders and physical addresses.
SC Daily Phone Spam List (data4marketers.com)
Breach date: 2015-04-14
Accounts affected: 32939105
Data exposed: Dates of birth, Email addresses, Genders, IP addresses, Names, Physical addresses
In early 2015, a spam list known as SC Daily Phone emerged containing almost 33M identities. The data includes personal attributes such as names, physical and IP addresses, genders, birth dates and phone numbers. Read more about spam lists in HIBP.
Scentbird (scentbird.com)
Breach date: 2020-06-22
Accounts affected: 5814988
Data exposed: Dates of birth, Email addresses, Genders, Names, Password strengths, Passwords
In June 2020, the online fragrance service Scentbird suffered a data breach that exposed the personal information of over 5.8 million customers. Personal information including names, email addresses, genders, dates of birth, passwords stored as bcrypt hashes and indicators of password strength were all exposed. The data was provided to HIBP by breachbase.pw.
schenkYOU (schenkyou.de)
Breach date: 2024-08-15
Accounts affected: 237349
Data exposed: Dates of birth, Email addresses, Names, Passwords
In September 2024, data from the online German gift store schenkYOU was put up for sale on a popular hacking forum. Obtained the month before, the data included 237k unique email addresses alongside names, dates of birth and salted SHA-256 password hashes. The standalone store was subsequently shut down with all traffic redirected to their Amazon store.
Scholastic (scholastic.com)
Breach date: 2025-01-08
Accounts affected: 4247768
Data exposed: Email addresses, Names, Phone numbers, Physical addresses
In January 2025, a data breach of the publishing company Scholastic surfaced. The breach contained 4.2M unique email addresses with many of the records also including name, phone number and physical address.
School District 42 (sd42.ca)
Breach date: 2023-01-15
Accounts affected: 18850
Data exposed: Email addresses, Names
In January 2023, Pitt Meadows School District 42 in British Columbia suffered a data breach. The incident exposed the names and email addresses of approximately 19k students and staff which were consequently redistributed on a popular hacking forum.
Scuf Gaming (scufgaming.com)
Breach date: 2015-06-05
Accounts affected: 128683
Data exposed: Display names, Email addresses, IP addresses, Passwords, Usernames
In June 2015, custom gaming controller maker Scuf Gaming suffered a data breach. The incident exposed 129k unique email addresses along with usernames, display names, IP addresses and password hashes.
Seedpeer (seedpeer.eu)
Breach date: 2015-07-12
Accounts affected: 281924
Data exposed: Email addresses, Passwords, Usernames
In July 2015, the torrent site Seedpeer was hacked and 282k member records were exposed. The data included usernames, email addresses and passwords stored as weak MD5 hashes.
Senior Dating (seniordating.app)
Breach date: 2024-11-23
Accounts affected: 765517
Data exposed: Bios, Dates of birth, Drinking habits, Education levels, Email addresses, Genders, Geographic locations, Occupations, Profile photos, Relationship statuses, Smoking habits, Social media profiles
In 2024, the 40+ dating website Senior Dating suffered a data breach. Attributed to an exposed Firebase database, the breach included extensive personal information on 766k users of the service including email addresses, photos, genders, links to Facebook accounts, dates of birth and precise latitude and longitude, among other personal attributes. The website was shut down after the breach was acknowledged by the site operator in December, along with a breach of the "ladies.com" website run by the same organisation.
Sephora (sephora.com.au)
Breach date: 2017-01-09
Accounts affected: 780073
Data exposed: Dates of birth, Email addresses, Ethnicities, Genders, Names, Physical attributes
In approximately January 2017, the beauty store Sephora suffered a data breach. Impacting customers in South East Asia, Australia and New Zealand, 780k unique email addresses were included in the breach alongside names, genders, dates of birth, ethnicities and other personal information.
ServerPact (serverpact.com)
Breach date: 2016-01-01
Accounts affected: 73587
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames
In mid-2015, the Dutch Minecraft site ServerPact was hacked and 73k accounts were exposed. Along with birth dates, email and IP addresses, the site also exposed SHA1 password hashes with the username as the salt.
SevenRooms (sevenrooms.com)
Breach date: 2022-12-11
Accounts affected: 1205385
Data exposed: Email addresses, Names, Purchases
In December 2022, over 400GB of data belonging to restaurant customer management platform SevenRooms was posted for sale to a popular hacking forum. The data included 1.2M unique email addresses alongside names and purchases. SevenRooms advised that the breach was due to unauthorised access of "a file transfer interface of a third-party vendor".
Shadi.com (shadi.com)
Breach date: 2016-07-09
Accounts affected: 2021984
Data exposed: Email addresses, Passwords
In July 2016, the Muslim dating site Shadi.com suffered a data breach that exposed over 2M members' email addresses. The breach also exposed passwords stored as MD5 hashes alongside their plain text equivalents.
Shadow (shadow.tech)
Breach date: 2023-09-28
Accounts affected: 543295
Data exposed: Dates of birth, Email addresses, Names, Physical addresses
In September 2023, the cloud gaming provider Shadow suffered a data breach that exposed over half a million customer records. The data included email and physical addresses, names and dates of birth.
ShareThis (sharethis.com)
Breach date: 2018-07-09
Accounts affected: 40960499
Data exposed: Dates of birth, Email addresses, Names, Passwords
In July 2018, the social bookmarking and sharing service ShareThis suffered a data breach. The incident exposed 41 million unique email addresses alongside names and in some cases, dates of birth and password hashes. In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly. The data was provided to HIBP by dehashed.com.
SHEIN (shein.com)
Breach date: 2018-06-01
Accounts affected: 39086762
Data exposed: Email addresses, Passwords
In June 2018, online fashion retailer SHEIN suffered a data breach. The company discovered the breach 2 months later in August then disclosed the incident another month after that. A total of 39 million unique email addresses were found in the breach alongside MD5 password hashes.
Shitexpress (shitexpress.com)
Breach date: 2022-08-08
Accounts affected: 23817
Data exposed: Email addresses, IP addresses, Names, Physical addresses, Private messages, Purchases
In August 2022, the online faeces delivery service Shitexpress suffered a data breach that exposed 24k unique email addresses. The addresses spanned invoices, gift cards, promotions and PayPal records. The breach also exposed the IP and email addresses of senders, physical addresses of recipients and messages accompanying the shit delivery.
ShockGore (shockgore.com)
Breach date: 2020-08-11
Accounts affected: 73944
Data exposed: Email addresses, Genders, IP addresses, Passwords, Private messages, Usernames
In August 2020, the website for sharing graphic videos and images of gore and animal cruelty suffered a data breach. The breach exposed 74k unique email addresses alongside usernames, IP addresses, genders and unsalted SHA-1 password hashes. Private messages were also exposed, many containing requests for material of a depraved nature.
Shoe Zone (shoezone.com)
Breach date: 2024-06-28
Accounts affected: 46140
Data exposed: Email addresses, Names, Partial credit card data, Physical addresses, Purchases
In June 2024, the UK footwear chain Shoe Zone disclosed a data breach that was subsequently posted for sale on a popular hacking forum. The data included over 100k orders containing names, addresses, partial credit card numbers (card type and last 4 digits), and 46k unique email addresses.
ShopBack (shopback.com)
Breach date: 2020-09-17
Accounts affected: 20529819
Data exposed: Email addresses, Geographic locations, Names, Passwords, Phone numbers
In September 2020, the cashback reward program ShopBack suffered a data breach. The incident exposed over 20 million unique email addresses along with names, phone numbers, country of residence and passwords stored as salted SHA-1 hashes. The data was provided to HIBP by dehashed.com.
Shopper+ (shopperplus.ca)
Breach date: 2020-09-14
Accounts affected: 878290
Data exposed: Dates of birth, Email addresses, Genders, Names, Phone numbers, Physical addresses, Spoken languages
In March 2023, "Canada's online shopping mall" Shopper+ disclosed a data breach discovered on a public hacking forum. The breach dated back to September 2020 and included 878k customer records with email and physical addresses, names, phone numbers and in some cases, genders and dates of birth.
Short Édition (short-edition.com)
Breach date: 2021-06-26
Accounts affected: 505466
Data exposed: Dates of birth, Email addresses, Genders, Names, Passwords, Phone numbers, Physical addresses, Social media profiles, Usernames
In June 2021, the French publishing house of short literature Short Édition suffered a data breach that exposed 505k records. Impacted data included email and physical addresses, names, usernames, phone numbers, dates of birth, genders and passwords stored as either salted SHA-1 or salted SHA-512 hashes. Short Édition self-submitted the impacted data to HIBP.
Shotbow (shotbow.net)
Breach date: 2016-05-09
Accounts affected: 1052753
Data exposed: Email addresses, Passwords, Usernames
In May 2016, the multiplayer server for Minecraft service Shotbow announced they'd suffered a data breach. The incident resulted in the exposure of over 1 million unique email addresses, usernames and salted SHA-256 password hashes.
SirHurt (sirhurt.net)
Breach date: 2021-04-23
Accounts affected: 90655
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In April 2021, the the Roblox cheats website SirHurt suffered a data breach that exposed over 90k customer records. The exposed data included email and IP addresses, usernames and passwords stored as MD5 hashes.
SitePoint (sitepoint.com)
Breach date: 2020-06-20
Accounts affected: 1021790
Data exposed: Bios, Email addresses, IP addresses, Names, Passwords, Usernames
In June 2020, the web development site SitePoint suffered a data breach that exposed over 1M customer records. Impacted data included email and IP addresses, names, usernames, bios and passwords stored as bcrypt hashes.
SkTorrent (sktorrent.eu)
Breach date: 2016-02-19
Accounts affected: 117070
Data exposed: Email addresses, Passwords, Usernames
In February 2016, the Slovak torrent tracking site SkTorrent was hacked and over 117k records leaked online. The data dump included usernames, email addresses and passwords stored in plain text.
Slickwraps (slickwraps.com)
Breach date: 2020-02-16
Accounts affected: 857611
Data exposed: Email addresses, Names, Phone numbers, Physical addresses, Purchases
In February 2020, the online store for consumer electronics wraps Slickwraps suffered a data breach. The incident resulted in the exposure of 858k unique email addresses across customer records and newsletter subscribers. Additional impacted data included names, physical addresses, phone numbers and purchase histories.
SlideTeam (slideteam.net)
Breach date: 2021-04-06
Accounts affected: 1464271
Data exposed: Email addresses, Names, Passwords
In April 2021, the "world’s largest collection of pre-designed presentation slides" SlideTeam had 1.4M records breached and later published to a popular hacking forum the following year. Allegedly sourced from a compromised Magento instance, the data included names, email addresses and passwords stored as salted hashes.
Smogon (smogon.com)
Breach date: 2017-09-10
Accounts affected: 386489
Data exposed: Email addresses, Genders, Geographic locations, Passwords, Usernames, Website activity
In April 2018, the Pokémon website known as Smogon announced they'd suffered a data breach. The breach dated back to September 2017 and affected their XenForo based forum. The exposed data included usernames, email addresses, genders and both bcrypt and MD5 password hashes.
Snail (snail.com)
Breach date: 2015-03-14
Accounts affected: 1410899
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In March 2015, the gaming website Snail suffered a data breach that impacted 1.4 million subscribers. The impacted data included usernames, IP and email addresses and passwords stored as unsalted MD5 hashes. The data was provided to HIBP by dehashed.com.
Snapchat (snapchat.com)
Breach date: 2014-01-01
Accounts affected: 4609615
Data exposed: Geographic locations, Phone numbers, Usernames
In January 2014 just one week after Gibson Security detailed vulnerabilities in the service, Snapchat had 4.6 million usernames and phone number exposed. The attack involved brute force enumeration of a large number of phone numbers against the Snapchat API in what appears to be a response to Snapchat's assertion that such an attack was "theoretical". Consequently, the breach enabled individual usernames (which are often used across other services) to be resolved to phone numbers which users usually wish to keep private.
SoarGames (soargames.com)
Breach date: 2019-12-16
Accounts affected: 4774445
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In December 2019, the now defunct gaming website SoarGames suffered a data breach that exposed 4.8M unique email addresses. The impacted data included usernames, email and IP addresses and salted MD5 password hashes. A significant number of the email addresses appeared to have been generated as opposed to organically provided by the user.
Social Engineered (socialengineered.net)
Breach date: 2019-06-13
Accounts affected: 89392
Data exposed: Email addresses, IP addresses, Passwords, Private messages, Usernames
In June 2019, the "Art of Human Hacking" site Social Engineered suffered a data breach. The breach of the MyBB forum was published on a rival hacking forum and included 89k unique email addresses spread across 55k forum users and other tables in the database. The exposed data also included usernames, IP addresses, private messages and passwords stored as salted MD5 hashes.
Società Italiana degli Autori ed Editori (siae.it)
Breach date: 2018-11-03
Accounts affected: 14609
Data exposed: Email addresses, IP addresses, Names, Passwords, Phone numbers
In November 2018, the Società Italiana degli Autori ed Editori (Italian Society of Authors and Publishers, or SIAE) was hacked, defaced and almost 4GB of data leaked publicly via Twitter. The data included over 14k registered users' names, email addresses and passwords.
SongTrivia2 (songtrivia2.io)
Breach date: 2026-04-02
Accounts affected: 291739
Data exposed: Auth tokens, Avatars, Email addresses, Names, Passwords, Usernames
In April 2026, the music trivia platform SongTrivia2 suffered a data breach that was subsequently published to a public hacking forum. The data contained a total of 291k unique email addresses sourced from either Google OAuth logins or accounts created on the site, the latter also containing bcrypt password hashes. The data also included names, usernames and avatars.
Sonicbids (sonicbids.com)
Breach date: 2019-12-30
Accounts affected: 751700
Data exposed: Email addresses, Names, Passwords, Usernames
In December 2019, the booking website Sonicbids suffered a data breach which they attributed to "a data privacy event involving our third-party cloud hosting services". The breach contained 752k user records including names and usernames, email addresses and passwords stored as PBKDF2 hashes. The data was provided to HIBP by breachbase.pw.