Tiago2024180/eyewebdataset huggingface dataset:
Fotolog (fotolog.com)
Breach date: 2018-12-01
Accounts affected: 16717854
Data exposed: Email addresses, Passwords, Usernames
In December 2018, the photo sharing social network Fotolog suffered a data breach that exposed 16.7 million unique email addresses. The data also included usernames and unsalted SHA-256 password hashes. The site was dissolved the following year and repurposed as a news website based in Brcko, Bosnia and Herzegovina.
Foxy Bingo (foxybingo.com)
Breach date: 2008-04-04
Accounts affected: 252216
Data exposed: Account balances, Browser user agent details, Dates of birth, Email addresses, Genders, Names, Passwords, Phone numbers, Physical addresses, Usernames, Website activity
In April 2007, the online gambling site Foxy Bingo was hacked and 252,000 accounts were obtained by the hackers. The breached records were subsequently sold and traded and included personal information data such as plain text passwords, birth dates and home addresses.
Frame & Optic (frameandoptic.com)
Breach date: 2025-01-16
Accounts affected: 15678
Data exposed: Email addresses, Geographic locations, Names, Phone numbers
In January 2025, the eyewear seller Frame & Optic suffered a data breach. The incident exposed almost 16k unique email addresses along with names, phone numbers and geolocation data including country, state and postcode.
Free (free.fr)
Breach date: 2024-10-17
Accounts affected: 13926173
Data exposed: Bank account numbers, Dates of birth, Genders, Names, Phone numbers, Physical addresses
In October 2024, French ISP "Free" suffered a data breach which was subsequently posted for sale and later, leaked publicly. The data included 14M unique email addresses along with names, physical addresses, phone numbers, genders, dates of birth and for many records, IBAN bank account numbers. Free advised that the numbers were "not enough to make a direct debit from a bank".
Freedom Hosting II (fhostingesps6bly.onion)
Breach date: 2017-01-31
Accounts affected: 380830
Data exposed: Email addresses, Passwords, Usernames
In January 2017, the free hidden service host Freedom Hosting II suffered a data breach. The attack allegedly took down 20% of dark web sites running behind Tor hidden services with the attacker claiming that of the 10,613 impacted sites, more than 50% of the content was child pornography. The hack led to the exposure of MySQL databases for the sites which included a vast amount of information on the hidden services Freedom Hosting II was managing. The impacted data classes far exceeds those listed for the breach and differ between the thousands of impacted sites.
FreeOnes (freeones.com)
Breach date: 2017-02-16
Accounts affected: 960213
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In February 2017, the forum for the adult website FreeOnes suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 960k unique email addresses alongside usernames, IP addresses and salted MD5 password hashes.
French Citizens ()
Breach date: 2024-09-25
Accounts affected: 28445106
Data exposed: Device information, Email addresses, IP addresses, Names, Partial credit card data, Phone numbers, Physical addresses
In September 2024, over 90M rows of data on French Citizens was found left exposed in a publicly facing database. Compiled from various data breaches, the corpus contained 28M unique email addresses with the various source breaches each exposing different fields including name, physical and IP address, phone number and partial credit card data including payment type and last 4 digits.
FreshMenu (freshmenu.com)
Breach date: 2016-07-01
Accounts affected: 110355
Data exposed: Device information, Email addresses, Names, Phone numbers, Physical addresses, Purchases
In July 2016, the India-based food delivery service FreshMenu suffered a data breach. The incident exposed the personal data of over 110k customers and included their names, email addresses, phone numbers, home addresses and order histories. When advised of the incident, FreshMenu acknowledged being already aware of the breach but stated they had decided not to notify impacted customers.
Fridae (fridae.asia)
Breach date: 2014-05-02
Accounts affected: 35368
Data exposed: Email addresses, Passwords, Usernames, Website activity
In May 2014, over 25,000 user accounts were breached from the Asian lesbian, gay, bisexual and transgender website known as "Fridae". The attack which was announced on Twitter appears to have been orchestrated by Deletesec who claim that "Digital weapons shall annihilate all secrecy within governments and corporations". The exposed data included password stored in plain text.
Funimation (funimation.com)
Breach date: 2016-07-01
Accounts affected: 2491103
Data exposed: Dates of birth, Email addresses, Passwords, Usernames
In July 2016, the anime site Funimation suffered a data breach that impacted 2.5 million accounts. The data contained usernames, email addresses, dates of birth and salted SHA1 hashes of passwords.
Funny Games (funny-games.biz)
Breach date: 2018-04-28
Accounts affected: 764357
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In April 2018, the online entertainment site Funny Games suffered a data breach that disclosed 764k records including usernames, email and IP addresses and salted MD5 password hashes. The incident was disclosed to Funny Games in July who acknowledged the breach and identified it had been caused by legacy code no longer in use. The record count in the breach constitute approximately half of the user base.
Fur Affinity (furaffinity.net)
Breach date: 2016-05-17
Accounts affected: 1270564
Data exposed: Email addresses, Passwords, Usernames
In May 2016, the Fur Affinity website for people with an interest in anthropomorphic animal characters (also known as "furries") was hacked. The attack exposed 1.2M email addresses (many accounts had a different "first" and "last" email against them) and hashed passwords.
Gaadi (gaadi.com)
Breach date: 2015-05-14
Accounts affected: 4261179
Data exposed: Email addresses, Genders, Geographic locations, IP addresses, Names, Passwords, Phone numbers, Usernames
In May 2015, the Indian motoring website known as Gaadi had 4.3 million records exposed in a data breach. The data contained usernames, email and IP addresses, genders, the city of users as well as passwords stored in both plain text and as MD5 hashes. The site was previously reported as compromised on the Vigilante.pw breached database directory.
Gab (gab.com)
Breach date: 2021-02-26
Accounts affected: 66521
Data exposed: Avatars, Email addresses, Names, Passwords, Private messages, Usernames
In February 2021, the alt-tech social network service Gab suffered a data breach. The incident exposed almost 70GB of data including 4M user accounts, a small number of private chat logs and a list of public groups and public posts made to the service. Only a small number of accounts included email addresses and / or passwords stored as bcrypt hashes with a total of 66.5k unique email addresses being exposed across the corpus of data.
Gamerzplanet (gamerzplanet.net)
Breach date: 2015-10-23
Accounts affected: 1217166
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In approximately October 2015, the online gaming forum known as Gamerzplanet was hacked and more than 1.2M accounts were exposed. The vBulletin forum included IP addresses and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked.
Games Box (gamesbox.com)
Breach date: 2020-09-21
Accounts affected: 1439354
Data exposed: Ages, Email addresses, Genders, Passwords, Usernames
In September 2020, now defunct website Games Box suffered a data breach that was later redistributed as part of a larger corpus of data. The impacted data included 1.4M email addresses alongside usernames, genders, ages and passwords stored as either a hash or plain text.
GameSalad (gamesalad.com)
Breach date: 2019-02-24
Accounts affected: 1506242
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In February 2019, the education and game creation website Game Salad suffered a data breach. The incident impacted 1.5M accounts and exposed email addresses, usernames, IP addresses and passwords stored as SHA-256 hashes.
GameSprite (gamesprite.me)
Breach date: 2019-12-17
Accounts affected: 6164643
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In December 2019, the now defunct gaming platform GameSprite suffered a data breach that exposed over 6M unique email addresses. The impacted data also included usernames, IP addresses and salted MD5 password hashes.
GameTuts (game-tuts.com)
Breach date: 2015-03-01
Accounts affected: 2064274
Data exposed: Email addresses, IP addresses, Passwords, Usernames
Likely in early 2015, the video game website GameTuts suffered a data breach and over 2 million user accounts were exposed. The site later shut down in July 2016 but was identified as having been hosted on a vBulletin forum. The exposed data included usernames, email and IP addresses and salted MD5 hashes.
GameVN (gamevn.com)
Breach date: 2016-05-01
Accounts affected: 1369485
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In May 2016, the Vietnamese gaming forum GameVN suffered a data breach that was later redistributed as part of a larger corpus of data. Data breached from the XenForo-based forum included 1.4M unique email addresses, usernames, IP addresses and salted MD5 password hashes.
Gamigo (gamigo.com)
Breach date: 2012-03-01
Accounts affected: 8243604
Data exposed: Email addresses, Passwords
In March 2012, the German online game publisher Gamigo was hacked and more than 8 million accounts publicly leaked. The breach included email addresses and passwords stored as weak MD5 hashes with no salt.
GamingMonk (gamingmonk.com)
Breach date: 2020-12-02
Accounts affected: 654510
Data exposed: Dates of birth, Email addresses, Names, Passwords, Phone numbers, Usernames
In December 2020, India's "largest esports community" GamingMonk (since acquired by and redirected to MPL Esports), suffered a data breach. The incident exposed 655k unique email addresses along with names, usernames, phone numbers, dates of birth and bcrypt password hashes.
GateHub (gatehub.net)
Breach date: 2019-06-04
Accounts affected: 1408078
Data exposed: Email addresses, Encrypted keys, Mnemonic phrases, Passwords
In October 2019, 1.4M accounts from the cryptocurrency wallet service GateHub were posted to a popular hacking forum. GateHub had previously acknowledged a data breach in June, albeit with a smaller number of impacted accounts. Data from the breach included email addresses, mnemonic phrases, encrypted master keys, encrypted recovery keys and passwords stored as bcrypt hashes.
Gawker (gawker.com)
Breach date: 2010-12-11
Accounts affected: 1247574
Data exposed: Email addresses, Passwords, Usernames
In December 2010, Gawker was attacked by the hacker collective "Gnosis" in retaliation for what was reported to be a feud between Gawker and 4Chan. Information about Gawkers 1.3M users was published along with the data from Gawker's other web presences including Gizmodo and Lifehacker. Due to the prevalence of password reuse, many victims of the breach then had their Twitter accounts compromised to send Acai berry spam.
Ge.tt (ge.tt)
Breach date: 2017-05-04
Accounts affected: 2481121
Data exposed: Email addresses, Names, Passwords, Social media profiles
In May 2017, the file sharing platform Ge.tt suffered a data breach. The data was subsequently put up for sale on a dark web marketplace in February 2019 alongside a raft of other breaches. The Ge.tt breach included names, social media profile identifiers, SHA256 password hashes and almost 2.5M unique email addresses.
GeekedIn (geekedin.net)
Breach date: 2016-08-15
Accounts affected: 1073164
Data exposed: Email addresses, Geographic locations, Names, Professional skills, Usernames, Years of professional experience
In August 2016, the technology recruitment site GeekedIn left a MongoDB database exposed and over 8M records were extracted by an unknown third party. The breached data was originally scraped from GitHub in violation of their terms of use and contained information exposed in public profiles, including over 1 million members' email addresses. Full details on the incident (including how impacted members can see their leaked data) are covered in the blog post on 8 million GitHub profiles were leaked from GeekedIn's MongoDB - here's how to see yours.
Gemini (gemini.com)
Breach date: 2022-12-13
Accounts affected: 5274214
Data exposed: Email addresses, Partial phone numbers
In late 2022, a hacker posted a data set to a public hacking forum which they alleged was sourced from the Gemini crypto exchange, a claim that was later proven to be false as the data was traced back to an incident at a third-party vendor. The source of the breach was later established as being Twilio, who processed the data of some Gemini customers using their Authy service for 2FA. Twilio described the incident as stemming from a sophisticated social engineering attack designed to steal employee credentials.
Gemplex (gemplex.tv)
Breach date: 2021-02-18
Accounts affected: 4563166
Data exposed: Device information, Email addresses, Names, Passwords, Phone numbers
In February 2021, the Indian streaming platform Gemplex suffered a data breach that exposed 4.6M user accounts. The impacted data included device information, names, phone numbers, email addresses and bcrypt password hashes.
Genesis Market (genesis.market)
Breach date: 2023-04-05
Accounts affected: 8000000
Data exposed: Browser user agent details, Credit card CVV, Credit cards, Dates of birth, Email addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
In April 2023, the stolen identity marketplace Genesis Market was shut down by the FBI and a coalition of law enforcement agencies across the globe in "Operation Cookie Monster". The service traded in "browser fingerprints" which enabled criminals to impersonate victims and access their online services. As many of the impacted accounts did not include email addresses, "8M" is merely an approximation intended to indicate scale. Other personal data compromised by the service included names, addresses and credit card information, although not all individuals had each of these fields exposed.
GeniusU (geniusu.com)
Breach date: 2020-10-02
Accounts affected: 1301460
Data exposed: Email addresses, Genders, IP addresses, Names, Passwords, Social media profiles
In November 2020, a collection of data breaches were made public including the "Entrepreneur Success Platform", GeniusU. Dating back to the previous month, the data included 1.3M names, email and IP addresses, genders, links to social media profiles and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
German Doner Kebab (germandonerkebab.com)
Breach date: 2025-03-27
Accounts affected: 162373
Data exposed: Email addresses, Names, Phone numbers, Physical addresses
In March 2025, data allegedly sourced from German Doner Kebab was published on a popular hacking forum. The data included 162k unique email addresses alongside names, phone numbers and physical addresses. German Doner Kebab subsequently sent a disclosure notice to impacted individuals.
Get Revenge On Your Ex (getrevengeonyourex.com)
Breach date: 2022-09-09
Accounts affected: 79195
Data exposed: Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Purchases
In September 2022, the revenge website Get Revenge On Your Ex suffered a data breach that exposed almost 80k unique email addresses. The data spanned both customers and victims including names, IP and physical addresses, phone numbers, purchase histories and plain text passwords. The data was subsequently shared on a public hacking forum, Get Revenge On Your Ex did not reply when contacted.
GFAN (gfan.com)
Breach date: 2016-10-10
Accounts affected: 22526334
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In October 2016, data surfaced that was allegedly obtained from the Chinese website known as GFAN and contained 22.5M accounts. Whilst there is evidence that the data is legitimate, due to the difficulty of emphatically verifying the Chinese breach it has been flagged as "unverified". The data in the breach contains email and IP addresses, user names and salted and hashed passwords. Read more about Chinese data breaches in Have I Been Pwned.
GGCorp (ggcorp.me)
Breach date: 2022-08-11
Accounts affected: 2376330
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In August 2022, the MMORPG website GGCorp suffered a data breach that exposed almost 2.4M unique email addresses. The data also included IP addresses, usernames and MD5 password hashes.
Giant Tiger (gianttiger.com)
Breach date: 2024-03-04
Accounts affected: 2842669
Data exposed: Email addresses, Names, Phone numbers, Physical addresses
In March 2024, Canadian discount store Giant Tiger suffered a data breach that exposed 2.8M customer records. Attributed to a vendor of the retailer, the breach included physical and email addresses, names and phone numbers.
Giglio (giglio.com)
Breach date: 2025-08-09
Accounts affected: 1026468
Data exposed: Email addresses, Names, Phone numbers, Physical addresses
In August 2025, over 1M unique email addresses appeared in a breach allegedly obtained from Italian fashion designer Giglio. The data also included names, phone numbers and physical addresses. Giglio did not respond to repeated attempts to disclose the incident.
GiveSendGo (givesendgo.com)
Breach date: 2022-02-07
Accounts affected: 89966
Data exposed: Email addresses, Geographic locations, Names, Purchases
In February 2022, the Christian fundraising service GiveSendGo suffered a data breach which exposed the personal data of 90k donors to the Canadian "Freedom Convoy" protest against vaccine mandates. The breach exposed names, email addresses, post codes, donation amount and comments left at the time of donation.
GLAMIRA (glamira.com)
Breach date: 2023-12-16
Accounts affected: 874594
Data exposed: Email addresses, Names, Phone numbers, Purchases
In late 2023, the online jewellery store GLAMIRA suffered a data breach they attributed to "an unauthorised individual [who] briefly accessed one of our servers". The data was subsequently published on a popular hacking forum and included 875k email addresses, names, phone numbers and purchases.
Glofox (glofox.com)
Breach date: 2020-03-27
Accounts affected: 2330735
Data exposed: Dates of birth, Email addresses, Genders, Names, Passwords, Phone numbers
In March 2020, the Irish gym management software company Glofox suffered a data breach which exposed 2.3M membership records. The data included email addresses, names, phone numbers, genders, dates of birth and passwords stored as unsalted MD5 hashes.
Go Games (gogames.me)
Breach date: 2015-10-24
Accounts affected: 3430083
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In approximately October 2015, the manga website Go Games suffered a data breach. The exposed data included 3.4M customer records including email and IP addresses, usernames and passwords stored as salted MD5 hashes. Go Games did not respond when contacted about the incident. The data was provided to HIBP by dehashed.com.
Go Ninja (goninja.de)
Breach date: 2019-12-17
Accounts affected: 4999001
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In December 2019, the now defunct German gaming website Go Ninja suffered a data breach that exposed 5M unique email addresses. The impacted data included usernames, email and IP addresses and salted MD5 password hashes. More than 4M of the email addresses appeared to have been generated as opposed to organically provided by the user.
GoldSilver (goldsilver.com)
Breach date: 2018-10-21
Accounts affected: 242715
Data exposed: Bank account numbers, Email addresses, IP addresses, Names, Partial credit card data, Passport numbers, Phone numbers, Physical addresses, Purchases, Security questions and answers, Social security numbers
In October 2018, the bullion education and dealer services site GoldSilver suffered a data breach that exposed 243k unique email addresses spanning customers and mailing list subscribers. An extensive amount of personal information on customers was obtained including names, addresses, phone numbers, purchases and passwords and answers to security questions stored as MD5 hashes. In a small number of cases, passport, social security numbers and partial credit card data was also exposed. The data breach and source code belonging to GoldSilver was publicly posted on a dark web service where it remained months later. When notified about the incident, GoldSilver advised that "all affected customers have been directly notified".
gPotato (gpotato.com)
Breach date: 2007-07-12
Accounts affected: 2136520
Data exposed: Dates of birth, Email addresses, Genders, IP addresses, Names, Passwords, Physical addresses, Security questions and answers, Usernames, Website activity
In July 2007, the multiplayer game portal known as gPotato (link to archive of the site at that time) suffered a data breach and over 2 million user accounts were exposed. The site later merged into the Webzen portal where the original accounts still exist today. The exposed data included usernames, email and IP addresses, MD5 hashes and personal attributes such as gender, birth date, physical address and security questions and answers stored in plain text.
GPS Underground (gpsunderground.com)
Breach date: 2016-07-01
Accounts affected: 669584
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames
In early 2017, GPS Underground was amongst a collection of compromised vBulletin websites that were found being sold online. The breach dated back to mid-2016 and included 670k records with usernames, email and IP addresses, dates of birth and salted MD5 password hashes.
Gravatar (gravatar.com)
Breach date: 2020-10-03
Accounts affected: 113990759
Data exposed: Email addresses, Names, Usernames
In October 2020, a security researcher published a technique for scraping large volumes of data from Gravatar, the service for providing globally unique avatars . 167 million names, usernames and MD5 hashes of email addresses used to reference users' avatars were subsequently scraped and distributed within the hacking community. 114 million of the MD5 hashes were cracked and distributed alongside the source hash, thus disclosing the original email address and accompanying data. Following the impacted email addresses being searchable in HIBP, Gravatar release an FAQ detailing the incident.
GSM Hosting (gsmhosting.com)
Breach date: 2016-08-01
Accounts affected: 2607440
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In August 2016, breached data from the vBulletin forum for GSM-Hosting appeared for sale alongside dozens of other hacked services. The breach impacted 2.6M users of the service and included email and IP addresses, usernames and salted MD5 password hashes.
GTAGaming (gtagaming.com)
Breach date: 2016-08-01
Accounts affected: 197184
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames, Website activity
In August 2016, the Grand Theft Auto forum GTAGaming was hacked and nearly 200k user accounts were leaked. The vBulletin based forum included usernames, email addresses and password hashes.
GunAuction.com (gunauction.com)
Breach date: 2022-12-03
Accounts affected: 565470
Data exposed: Browser user agent details, Email addresses, Genders, IP addresses, Partial credit card data, Partial dates of birth, Passwords, Phone numbers, Physical addresses, Usernames
In December 2022, the online firearms auction website GunAuction.com suffered a data breach which was later discovered left unprotected on the hacker's server. The data included over 565k user records with extensive personal data including email, IP and physical addresses, names, phone numbers, genders, years of birth, credit card type and passwords stored in plain text. The leaked identities could subsequently be matched to firearms listed for sale on the website.