Tiago2024180/eyewebdataset huggingface dataset:
Sony (sony.com)
Breach date: 2011-06-02
Accounts affected: 37103
Data exposed: Dates of birth, Email addresses, Genders, Names, Passwords, Phone numbers, Physical addresses, Usernames
In 2011, Sony suffered breach after breach after breach — it was a very bad year for them. The breaches spanned various areas of the business ranging from the PlayStation network all the way through to the motion picture arm, Sony Pictures. A SQL Injection vulnerability in sonypictures.com lead to tens of thousands of accounts across multiple systems being exposed complete with plain text passwords.
Sound Radix (soundradix.com)
Breach date: 2026-03-25
Accounts affected: 292993
Data exposed: Email addresses, Names, Passwords
In March 2026, the audio production tools company Sound Radix disclosed a data breach that they subsequently self-submitted to HIBP. The incident impacted 293k unique email addresses and names. Sound Radix advised that it is possible that additional data including hashed passwords may have been exposed, and that no financial or credit card information was impacted.
SoundCloud (soundcloud.com)
Breach date: 2025-12-15
Accounts affected: 29815722
Data exposed: Avatars, Email addresses, Geographic locations, Names, Profile statistics, Usernames
In December 2025, SoundCloud announced it had discovered unauthorised activity on its platform. The incident allowed an attacker to map publicly available SoundCloud profile data to email addresses for approximately 20% of its users. The impacted data included 30M unique email addresses, names, usernames, avatars, follower and following counts and, in some cases, the user’s country. The attackers later attempted to extort SoundCloud before publicly releasing the data the following month.
Soundwave (soundwave.com)
Breach date: 2015-07-16
Accounts affected: 130705
Data exposed: Dates of birth, Email addresses, Genders, Geographic locations, Names, Passwords, Social connections
In approximately mid 2015, the music tracking app Soundwave suffered a data breach. The breach stemmed from an incident whereby "production data had been used to populate the test database" and was then inadvertently exposed in a MongoDB. The data contained 130k records and included email addresses, dates of birth, genders and MD5 hashes of passwords without a salt.
Special K Data Feed Spam List (data4marketers.com)
Breach date: 2015-10-07
Accounts affected: 30741620
Data exposed: Dates of birth, Email addresses, Genders, IP addresses, Names, Physical addresses
In mid to late 2015, a spam list known as the Special K Data Feed was discovered containing almost 31M identities. The data includes personal attributes such as names, physical and IP addresses, genders, birth dates and phone numbers. Read more about spam lists in HIBP.
Speedio (speedio.com.br)
Breach date: 2024-12-24
Accounts affected: 27501041
Data exposed: Company names, Email addresses, Phone numbers, Physical addresses
In December 2024, data alleged to have been taken from the Brazilian lead generation platform Speedio was posted for sale to a popular hacking forum. The data was allegedly obtained from an unsecured Elasticsearch instance and contained over 62M records of largely public business information including company names, phone numbers and physical addresses, along with 27M unique email addresses, predominantly from public services such as Gmail and Outlook. Speedio did not respond to multiple attempts to disclose the incident, and the origin of the data could not be independently verified.
Sphero (sphero.com)
Breach date: 2023-09-09
Accounts affected: 832255
Data exposed: Dates of birth, Email addresses, Geographic locations, Names, Usernames
In September 2023, over 1M rows of data from the educational robots company Sphero was posted to a popular hacking forum. The data contained 832k unique email addresses alongside names, usernames, dates of birth and geographic locations.
Spirol (spirol.com)
Breach date: 2014-02-22
Accounts affected: 55622
Data exposed: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses
In February 2014, Connecticut based Spirol Fastening Solutions suffered a data breach that exposed over 70,000 customer records. The attack was allegedly mounted by exploiting a SQL injection vulnerability which yielded data from Spirol’s CRM system ranging from customers’ names, companies, contact information and over 55,000 unique email addresses.
Sport 2000 (sport2000.fr)
Breach date: 2024-04-18
Accounts affected: 3189643
Data exposed: Dates of birth, Email addresses, Names, Phone numbers, Physical addresses, Purchases, Salutations
In April 2024, the French sporting equipment manufacturer Sport 2000 announced it had suffered a data breach. The data was subsequently put up for sale on a popular hacking forum and included 4.4M rows with 3.2M unique email addresses alongside names, physical addresses, phone numbers, dates of birth and purchases made by store name.
Spoutible (spoutible.com)
Breach date: 2024-01-31
Accounts affected: 207114
Data exposed: Email addresses, Genders, IP addresses, Names, Passwords, Phone numbers, Usernames
In January 2024, Spoutible had 207k records scraped from a misconfigured API that inadvertently returned excessive personal information. The data included names, usernames, email and IP addresses, phone numbers (where provided to the platform), genders and bcrypt password hashes. The incident also exposed 2FA secrets and backup codes along with password reset tokens.
SpyFone (spyfone.com)
Breach date: 2018-08-16
Accounts affected: 44109
Data exposed: Audio recordings, Browsing histories, Device information, Email addresses, Geographic locations, IMEI numbers, IP addresses, Names, Passwords, Photos, SMS messages
In August 2018, the spyware company SpyFone left terabytes of data publicly exposed. Collected surreptitiously whilst the targets were using their devices, the data included photos, audio recordings, text messages and browsing history which were then exposed via a number of misconfigurations within SpyFone's systems. The data belonged the thousands of SpyFone customers and included 44k unique email addresses, many likely belonging to people the targeted phones had contact with.
Spyic (spyic.com)
Breach date: 2025-02-14
Accounts affected: 875999
Data exposed: Email addresses
In February 2025, the spyware service Spyic suffered a data breach along with sibling spyware service, Cocospy. The Spyic breach alone exposed almost 876k customer email addresses which were provided to HIBP, and reportedly also enabled unauthorised access to captured messages, photos, call logs, and more.
Spytech (spytech-web.com)
Breach date: 2024-06-04
Accounts affected: 5645
Data exposed: Browsing histories, Device information, Email addresses, Names, Passwords, Purchases, Usernames
In July 2024, spyware maker Spytech suffered a data breach that exposed data collected as recently as the previous month. Designed to "invisibly record everything users do", the breach exposed information related to both purchasers and targets of the product. Target data collection (and subsequent exposure) included the infected computer name, browsing history, applications used, usernames of authenticated users, keywords being monitored, file operations (creation and deletion), computer usage times and email addresses, often captured within the spyware's logs. The data also included the names, purchases and md5 password hashes of purchasers.
SpyX (spyx.com)
Breach date: 2024-06-24
Accounts affected: 1977011
Data exposed: Device information, Email addresses, Geographic locations, IP addresses, Passwords
In June 2024, spyware maker SpyX suffered a data breach that exposed almost 2M unique email addresses. The breach also exposed IP addresses, countries of residence, device information and 6-digit PINs in the password field. Further, a collection of iCloud credentials likely used to monitor targets directly via the cloud were also in the breach and contained the target's email address and plain text Apple password.
Spyzie (spyzie.io)
Breach date: 2024-02-22
Accounts affected: 518643
Data exposed: Email addresses
In February 2025, the spyware service Spyzie suffered a data breach along with sibling spyware services, Spyic and Cocospy. The Spyzie breach alone exposed almost 519k customer email addresses which were provided to HIBP, and reportedly also enabled unauthorised access to captured messages, photos, call logs, and more.
Stalker Online (stalker.so)
Breach date: 2020-05-05
Accounts affected: 1385472
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In May 2020, over 1.3M records from the MMO game Stalker Online were breached. The data included email and IP addresses, usernames and hashed passwords.
Staminus (staminus.net)
Breach date: 2016-03-11
Accounts affected: 26815
Data exposed: Credit cards, Email addresses, IP addresses, Passwords, Support tickets, Usernames
In March 2016, the DDoS protection service Staminus was "massively hacked" resulting in an outage of more than 20 hours and the disclosure of customer credentials (with unsalted MD5 hashes), support tickets, credit card numbers and other sensitive data. 27k unique email addresses were found in the data which was subsequently released to the public. Staminus is no longer in operation.
StarNet (starnet.md)
Breach date: 2015-02-26
Accounts affected: 139395
Data exposed: Customer interactions, Dates of birth, Email addresses, Genders, IP addresses, MAC addresses, Names, Passport numbers, Passwords, Phone numbers
In February 2015, the Moldavian ISP "StarNet" had it's database published online. The dump included nearly 140k email addresses, many with personal details including contact information, usage patterns of the ISP and even passport numbers.
START (start.film)
Breach date: 2021-06-01
Accounts affected: 7455386
Data exposed: Email addresses, Geographic locations, Names, Passwords
In August 2022, news broke of an attack against the Russian streaming service "START". The incident led to the exposure of 44M records containing 7.4M unique email addresses. The impacted data also included the subscriber's country and password hash. START subsequently acknowledged the incident in a Telegram post and stated that the data dated back to 2021.
StarTribune (startribune.com)
Breach date: 2019-10-10
Accounts affected: 2192857
Data exposed: Dates of birth, Email addresses, Genders, Names, Passwords, Physical addresses, Usernames
In October 2019, the Minnesota-based news service StarTribune suffered a data breach which was subsequently sold on the dark web. The breach exposed over 2 million unique email addresses alongside names, usernames, physical addresses, dates of birth, genders and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
Stealer Logs Posted to Telegram ()
Breach date: 2024-07-18
Accounts affected: 26105473
Data exposed: Email addresses, Passwords
In July 2024, info stealer logs with 26M unique email addresses were collated from malicious Telegram channels. The data contained 22GB of logs consisting of email addresses, passwords and the websites they were used on, all obtained by malware running on infected machines.
Stealer Logs, Jan 2025 ()
Breach date: 2025-01-13
Accounts affected: 71039833
Data exposed: Email addresses, Passwords
In January 2025, stealer logs with 71M email addresses were added to HIBP. Consisting of email address, password and the website the credentials were entered against, this breach marks the launch of a new HIBP feature enabling the retrieval of the specific websites the logs were collected against. The incident also resulted in 106M more passwords being added to the Pwned Passwords service.
Ster-Kinekor (sterkinekor.co.za)
Breach date: 2017-03-09
Accounts affected: 1619544
Data exposed: Dates of birth, Email addresses, Genders, Names, Passwords, Phone numbers, Physical addresses, Spoken languages
In 2016, the South African cinema company Ster-Kinekor had a security flaw which leaked a large amount of customer data via an enumeration vulnerability in the API of their old website. Whilst more than 6 million accounts were leaked by the flaw, the exposed data only contained 1.6 million unique email addresses. The data also included extensive personal information such as names, addresses, birthdates, genders and plain text passwords.
StockX (stockx.com)
Breach date: 2019-07-26
Accounts affected: 6840339
Data exposed: Email addresses, Names, Passwords, Physical addresses, Purchases, Usernames
In July 2019, the fashion and sneaker trading platform StockX suffered a data breach which was subsequently sold via a dark webmarketplace. The exposed data included 6.8 million unique email addresses, names, physical addresses, purchases and passwords stored as salted MD5 hashes. The data was provided to HIBP by dehashed.com.
Storenvy (storenvy.com)
Breach date: 2019-04-04
Accounts affected: 11052071
Data exposed: Dates of birth, Email addresses, Genders, Geographic locations, IP addresses, Passwords, Usernames
In mid-2019, the e-commerce website Storenvy suffered a data breach that exposed millions of customer records. A portion of the breached records were subsequently posted to a hacking forum with cracked password hashes, whilst the entire corpus of 23M rows was put up for sale. The data contained 11M unique email addresses alongside usernames, IP addresses, the user's city, gender date of birth and original salted SHA-1 password hash.
StoryBird (storybird.com)
Breach date: 2015-08-07
Accounts affected: 1047200
Data exposed: Email addresses, Names, Passwords, Usernames
In August 2015, the storytelling service StoryBird suffered a data breach exposing 4 million records with 1 million unique email addresses. Impacted data also included names, usernames and passwords stored as PBKDF2 hashes. The data was provided to HIBP by dehashed.com.
Straffic (straffic.io)
Breach date: 2020-02-14
Accounts affected: 48580249
Data exposed: Email addresses, Genders, Names, Phone numbers, Physical addresses
In February 2020, Israeli marketing company Straffic exposed a database with 140GB of personal data. The publicly accessible Elasticsearch database contained over 300M rows with 49M unique email addresses. Exposed data also included names, phone numbers, physical addresses and genders. In their breach disclosure message, Straffic stated that "it is impossible to create a totally immune system, and these things can occur".
Stratfor (stratfor.com)
Breach date: 2011-12-24
Accounts affected: 859777
Data exposed: Credit cards, Email addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
In December 2011, "Anonymous" attacked the global intelligence company known as "Stratfor" and consequently disclosed a veritable treasure trove of data including hundreds of gigabytes of email and tens of thousands of credit card details which were promptly used by the attackers to make charitable donations (among other uses). The breach also included 860,000 user accounts complete with email address, time zone, some internal system data and MD5 hashed passwords with no salt.
StreamCraft (streamcraft.net)
Breach date: 2020-07-06
Accounts affected: 1772620
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In July 2020, the Russian Minecraft service StreamCraft suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 1.8M records of usernames, email and IP addresses and passwords stored as either MD5 or bcrypt hashes.
StreetEasy (streeteasy.com)
Breach date: 2016-06-28
Accounts affected: 988230
Data exposed: Email addresses, Names, Passwords, Usernames
In approximately June 2016, the real estate website StreetEasy suffered a data breach. In total, 988k unique email addresses were included in the breach alongside names, usernames and SHA-1 hashes of passwords, all of which appeared for sale on a dark web marketplace in February 2019.
Stripchat (stripchat.com)
Breach date: 2021-11-05
Accounts affected: 10001355
Data exposed: Email addresses, IP addresses, Usernames
In November 2021, the live sex cams and adult chat website Stripchat left several databases exposed and unsecured. In June the following year, over 10M Stripchat records appeared on a popular hacking forum. The exposed data included usernames, email addresses and IP addresses.
Stronghold Kingdoms (strongholdkingdoms.com)
Breach date: 2018-07-04
Accounts affected: 5187305
Data exposed: Email addresses, Passwords, Usernames
In July 2018, the massive multiplayer online game Stronghold Kingdoms suffered a data breach. Almost 5.2 million accounts were impacted by the incident which exposed emails addresses, usernames and passwords stored as salted SHA-1 hashes.
SubaGames (subagames.com)
Breach date: 2016-11-01
Accounts affected: 6137666
Data exposed: Email addresses, Passwords, Usernames
In November 2016, the game developer Suba Games suffered a data breach which led to the exposure of 6.1M unique email addresses. Impacted data also included usernames and passwords, most of which appeared circulating in the breached file in plain text after being cracked from salted MD5 hashes. The data was provided to HIBP by dehashed.com.
Substack (substack.com)
Breach date: 2025-10-23
Accounts affected: 663121
Data exposed: Email addresses, Phone numbers
In October 2025, the publishing platform Substack suffered a data breach that was subsequently circulated more widely in February 2026. The breach exposed 663k account holder records containing email addresses along with publicly visible profile information from Substack accounts, such as publication names and bios. A subset of records also included phone numbers.
SUCCESS (success.com)
Breach date: 2026-03-04
Accounts affected: 253510
Data exposed: Device information, Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Purchases
In March 2026, the personal development and achievement media brand SUCCESS suffered a data breach. The incident exposed 250k unique email addresses along with names, IP addresses, phone numbers and, for a limited number of staff members, bcrypt password hashes. The data also included orders containing physical addresses and the payment method used. In SUCCESS' disclosure notice, they advised their system had also been abused to send offensive newsletters with quotes falsely attributed to contributors.
Sumo Torrent (sumotorrent.sx)
Breach date: 2014-06-21
Accounts affected: 285191
Data exposed: Email addresses, IP addresses, Passwords, Usernames, Website activity
In June 2014, the torrent site Sumo Torrent was hacked and 285k member records were exposed. The data included IP addresses, email addresses and passwords stored as weak MD5 hashes.
Sundry Files (sundryfiles.com)
Breach date: 2022-01-21
Accounts affected: 274461
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In January 2022, the now defunct file upload service Sundry Files suffered a data breach that exposed 274k unique email addresses. The data also included usernames, IP addresses and passwords stored as salted SHA-256 hashes.
SuperDraft (superdraft.io)
Breach date: 2024-10-27
Accounts affected: 300187
Data exposed: Dates of birth, Email addresses, Geographic locations, Passwords, Purchases, Usernames
In October 2024, the fantasy sports platform SuperDraft suffered a data breach that exposed over 300k customer records. The breach contained 24GB of data including email addresses, usernames, purchases, latitudes and longitudes, dates of birth and bcrypt password hashes.
SuperVPN & GeckoVPN ()
Breach date: 2021-02-25
Accounts affected: 20339937
Data exposed: Device information, Device serial numbers, Email addresses, Geographic locations, IMSI numbers, Login histories
In February 2021, a series of "free" VPN services were breached including SuperVPN and GeckoVPN, exposing over 20M records. The data appeared together in a single file with a small number of records also included from FlashVPN, suggesting that all three brands may share the same platform. Impacted data also included email addresses, the country logged in from and the date and time each login occurred alongside device information including the make and model, IMSI number and serial number.
SurveyLama (surveylama.com)
Breach date: 2024-02-01
Accounts affected: 4426879
Data exposed: Dates of birth, Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses
In February 2024, the paid survey website SurveyLama suffered a data breach that exposed 4.4M customer email addresses. The incident also exposed names, physical and IP addresses, phone numbers, dates of birth and passwords stored as either salted SHA-1, bcrypt or argon2 hashes. When contacted about the incident, SurveyLama advised that they had already "notified the users by email".
SvenskaMagic (svenskamagic.com)
Breach date: 2015-07-01
Accounts affected: 30327
Data exposed: Email addresses, Passwords, Usernames
Sometime in 2015, the Swedish magic website SvenskaMagic suffered a data breach that exposed over 30k records. The compromised data included usernames, email addresses and MD5 password hashes. The data was self-submitted to HIBP by SvenskaMagic.
SweClockers.com (sweclockers.com)
Breach date: 2015-04-01
Accounts affected: 254867
Data exposed: Email addresses, Passwords, Usernames
In early 2015, the Swedish tech news site SweClockers was hacked and 255k accounts were exposed. The attack led to the exposure of usernames, email addresses and salted hashes of passwords stored with a combination of MD5 and SHA512.
Switch (switchit.hu)
Breach date: 2024-10-01
Accounts affected: 5397
Data exposed: Email addresses, Job applications, Names, Social media profiles
In October 2024, the Hungarian IT headhunting service Switch inadvertently exposed thousands of customer records via a public GitHub repository. The exposed data contained job applications with names, email addresses and in some cases, commentary on the applicant.
SwordFantasy (swordfantasy.com)
Breach date: 2017-01-20
Accounts affected: 2690657
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In January 2019, the now defunct MMO and RPG game SwordFantasy suffered a data breach that exposed 2.7M unique email addresses. Other impacted data included username, IP address and salted MD5 password hashes.
Swvl (swvl.com)
Breach date: 2020-06-23
Accounts affected: 4195918
Data exposed: Email addresses, Names, Partial credit card data, Passwords, Phone numbers, Profile photos
In June 2020, the Egyptian bus operator Swvl suffered a data breach which impacted over 4 million members of the service. The exposed data included names, email addresses, phone numbers, profile photos, partial credit card data (type and last 4 digits) and passwords stored as bcrypt hashes, all of which was subsequently shared extensively throughout online hacking communities. The data was provided to HIBP by breachbase.pw.
Synthient Credential Stuffing Threat Data ()
Breach date: 2025-04-11
Accounts affected: 1957476021
Data exposed: Email addresses, Passwords
During 2025, the threat-intelligence firm Synthient aggregated 2 billion unique email addresses disclosed in credential-stuffing lists found across multiple malicious internet sources. Comprised of email addresses and passwords from previous data breaches, these lists are used by attackers to compromise other, unrelated accounts of victims who have reused their passwords. The data also included 1.3 billion unique passwords, which are now searchable in Pwned Passwords. Working to turn breached data into awareness, Synthient partnered with HIBP to help victims of cybercrime understand their exposure.
Synthient Stealer Log Threat Data ()
Breach date: 2025-04-11
Accounts affected: 182962095
Data exposed: Email addresses, Passwords
During 2025, Synthient aggregated billions of records of "threat data" from various internet sources. The data contained 183M unique email addresses alongside the websites they were entered into and the passwords used. After normalising and deduplicating the data, 183 million unique email addresses remained, each linked to the website where the credentials were captured, and the password used. This dataset is now searchable in HIBP by email address, password, domain, and the site on which the credentials were entered.