Tiago2024180/eyewebdataset huggingface dataset:
AndroidLista (androidlista.com)
Breach date: 2021-07-28
Accounts affected: 6640643
Data exposed: Email addresses, Names, Passwords, Usernames
In July 2021, the Android applications and games review site AndroidLista suffered a data breach. The incident exposed 6.6M user records containing email addresses, names, usernames and passwords stored as salted SHA-1 hashes, all of which were subsequently posted to a popular hacking forum. AndroidLista did not respond when contacted about the breach.
Animal Jam (animaljam.com)
Breach date: 2020-10-12
Accounts affected: 7104998
Data exposed: Dates of birth, Email addresses, Genders, IP addresses, Names, Passwords, Physical addresses, Usernames
In October 2020, the online game for kids Animal Jam suffered a data breach which was subsequently shared through online hacking communities the following month. The data contained 46 million user accounts with over 7 million unique email addresses. Impacted data also included usernames, IP addresses and for some records, dates of birth (sometimes in partial form), physical addresses, parent names and passwords stored as PBKDF2 hashes.
AnimeGame (animegame.me)
Breach date: 2020-02-27
Accounts affected: 1431378
Data exposed: Email addresses, Passwords, Usernames
In February 2020, the gaming website AnimeGame suffered a data breach. The incident affected 1.4M subscribers and exposed email addresses, usernames and passwords stored as salted MD5 hashes. The data was subsequently shared on a popular hacking forum and was provided to HIBP by dehashed.com.
Animeify (animeify.net)
Breach date: 2021-10-14
Accounts affected: 808034
Data exposed: Email addresses, Genders, Names, Passwords, Usernames
In October 2021, the now defunct Arabic language Anime website Animeify suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 808k unique email addresses along with names, usernames, genders and plain text passwords.
AnimeLeague (animeleague.net)
Breach date: 2024-07-04
Accounts affected: 192134
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Phone numbers, Private messages, Purchases, Usernames
In July 2024, AnimeLeague disclosed a data breach of their services. The data was posted for sale on a popular hacking forum and included 2 databases covering both event registration records and a dump of the phpBB bulletin board. The impacted data included passwords in various hashed formats including SHA-1, salted md5 and bcrypt, as well as usernames, private messages, dates of birth, purchases and 192k unique email addresses.
Anime-Planet (anime-planet.com)
Breach date: 2016-01-01
Accounts affected: 368507
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames
In approximately 2016, the anime website Anime-Planet suffered a data breach that impacted 369k subscribers. The exposed data included usernames, IP and email addresses, dates of birth and passwords stored as unsalted MD5 hashes and for newer accounts, bcrypt hashes. The data was provided to HIBP by dehashed.com.
Animoto (animoto.com)
Breach date: 2018-07-10
Accounts affected: 22437749
Data exposed: Dates of birth, Email addresses, Geographic locations, Names, Passwords
In July 2018, the cloud-based video making service Animoto suffered a data breach. The breach exposed 22 million unique email addresses alongside names, dates of birth, country of origin and salted password hashes.
Anti Public Combo List ()
Breach date: 2016-12-16
Accounts affected: 457962538
Data exposed: Email addresses, Passwords
In December 2016, a huge list of email address and password pairs appeared in a "combo list" referred to as "Anti Public". The list contained 458 million unique email addresses, many with multiple different passwords hacked from various online systems. The list was broadly circulated and used for "credential stuffing", that is attackers employ it in an attempt to identify other online systems where the account owner had reused their password. For detailed background on this incident, read Password reuse, credential stuffing and another billion records in Have I Been Pwned.
ApexSMS ()
Breach date: 2019-04-15
Accounts affected: 23246481
Data exposed: Email addresses, Genders, Geographic locations, IP addresses, Names, Phone numbers, Telecommunications carrier
In May 2019, news broke of a massive SMS spam operation known as "ApexSMS" which was discovered after a MongoDB instance of the same name was found exposed without a password. The incident leaked over 80M records with 23M unique email addresses alongside names, phone numbers and carriers, geographic locations (state and country), genders and IP addresses.
APK.TW (apk.tw)
Breach date: 2022-09-03
Accounts affected: 2451197
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In September 2022, the Taiwanese Android forum APK.TW suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed 2.5M unique email addresses along with IP addresses, usernames and salted MD5 password hashes.
APOIA.se (apoia.se)
Breach date: 2025-12-16
Accounts affected: 450764
Data exposed: Email addresses, Names, Physical addresses
In December 2025, a database of the Brazilian crowdfunding platform APOIA.se was posted to an online forum. In January 2026, the company confirmed it had suffered a data breach. The incident exposed 451k unique email addresses along with names and physical addresses.
Apollo (apollo.io)
Breach date: 2018-07-23
Accounts affected: 125929660
Data exposed: Email addresses, Employers, Geographic locations, Job titles, Names, Phone numbers, Salutations, Social media profiles
In July 2018, the sales engagement startup Apollo left a database containing billions of data points publicly exposed without a password. The data was discovered by security researcher Vinny Troia who subsequently sent a subset of the data containing 126 million unique email addresses to Have I Been Pwned. The data left exposed by Apollo was used in their "revenue acceleration platform" and included personal information such as names and email addresses as well as professional information including places of employment, the roles people hold and where they're located. Apollo stressed that the exposed data did not include sensitive information such as passwords, social security numbers or financial data. The Apollo website has a contact form for those looking to get in touch with the organisation.
Appartoo (appartoo.com)
Breach date: 2017-03-25
Accounts affected: 49681
Data exposed: Ages, Auth tokens, Email addresses, Employment statuses, Genders, IP addresses, Marital statuses, Names, Passwords, Physical addresses, Private messages, Social media profiles
In March 2017, the French Flatsharing site known as Appartoo suffered a data breach. The incident exposed an extensive amount of personal information on almost 50k members including email addresses, genders, ages, private messages sent between users of the service and passwords stored as SHA-256 hashes. Appartoo advised that all subscribers were notified of the incident in early 2017.
Appen (appen.com)
Breach date: 2020-06-22
Accounts affected: 5888405
Data exposed: Email addresses, Employers, IP addresses, Names, Passwords, Phone numbers
In June 2020, the AI training data company Appen suffered a data breach exposing the details of almost 5.9 million users which were subsequently sold online. Included in the breach were names, email addresses and passwords stored as bcrypt hashes. Some records also contained phone numbers, employers and IP addresses. The data was provided to HIBP by dehashed.com.
Aptoide (aptoide.com)
Breach date: 2020-04-13
Accounts affected: 20012235
Data exposed: Browser user agent details, Email addresses, IP addresses, Names, Passwords
In April 2020, the independent Android app store Aptoide suffered a data breach. The incident resulted in the exposure of 20M customer records which were subsequently shared online via a popular hacking forum. Impacted data included email and IP addresses, names, IP addresses and passwords stored as SHA-1 hashes without a salt.
Armor Games (armorgames.com)
Breach date: 2019-01-01
Accounts affected: 10604307
Data exposed: Bios, Dates of birth, Email addresses, Genders, Geographic locations, IP addresses, Passwords, Usernames
In January 2019, the game portal website Armor Games suffered a data breach. A total of 10.6 million email addresses were impacted by the breach which also exposed usernames, IP addresses, birthdays of administrator accounts and passwords stored as salted SHA-1 hashes.
Army Force Online (armyforceonline.com)
Breach date: 2016-05-18
Accounts affected: 1531235
Data exposed: Avatars, Email addresses, Geographic locations, IP addresses, Names, Passwords, Usernames, Website activity
In May 2016, the online gaming site Army Force Online suffered a data breach that exposed 1.5M accounts. The breached data was found being regularly traded online and included usernames, email and IP addresses and MD5 passwords.
Artists&Clients (artistsnclients.com)
Breach date: 2025-08-31
Accounts affected: 95351
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In August 2025, the "marketplace that connects artists to prospective clients" Artists&Clients, suffered a data breach and subsequent ransom demand of US$50k. The data was subsequently leaked publicly and included 95k unique email addresses alongside usernames, IP addresses and bcrypt password hashes.
Artsy (artsy.net)
Breach date: 2018-04-01
Accounts affected: 1079970
Data exposed: Email addresses, IP addresses, Names, Passwords
In April 2018, the online arts database Artsy suffered a data breach which consequently appeared for sale on a dark web marketplace. Over 1M accounts were impacted and included IP and email addresses, names and passwords stored as salted SHA-512 hashes.
Artvalue (artvalue.com)
Breach date: 2019-06-19
Accounts affected: 157692
Data exposed: Email addresses, Names, Passwords, Salutations, Usernames
In June 2019, the France-based art valuation website Artvalue.com left their 158k member subscriber base publicly exposed in a text file on their website. The exposed data included names, usernames, email addresses and passwords stored as MD5 hashes. The site operator did not respond when contacted about the incident, although the exposed file was subsequently removed.
Ashley Madison (ashleymadison.com)
Breach date: 2015-07-19
Accounts affected: 30811934
Data exposed: Dates of birth, Email addresses, Ethnicities, Genders, Names, Passwords, Payment histories, Phone numbers, Physical addresses, Security questions and answers, Sexual orientations, Usernames, Website activity
In July 2015, the infidelity website Ashley Madison suffered a serious data breach. The attackers threatened Ashley Madison with the full disclosure of the breach unless the service was shut down. One month later, the database was dumped including more than 30M unique email addresses. This breach has been classed as "sensitive" and is not publicly searchable, although individuals may discover if they've been impacted by registering for notifications. Read about this approach in detail.
Association Nationale des Premiers Secours (anps.fr)
Breach date: 2026-01-30
Accounts affected: 5600
Data exposed: Dates of birth, Email addresses, Names, Places of birth, Salutations
In January 2026, a data breach impacting the French non-profit Association Nationale des Premiers Secours (ANPS) was posted to a hacking forum. The breach exposed 5.6k unique email addresses along with names, dates of birth and places of birth. ANPS self-submitted the data to HIBP and advised the incident was traced back to a legacy system and did not impact health data, financial information or passwords.
Astropid (astropid.com)
Breach date: 2013-12-19
Accounts affected: 5788
Data exposed: Email addresses, Instant messenger identities, IP addresses, Names, Passwords, Private messages, Usernames, Website activity
In December 2013, the vBulletin forum for the social engineering site known as "AstroPID" was breached and leaked publicly. The site provided tips on fraudulently obtaining goods and services, often by providing a legitimate "PID" or Product Information Description. The breach resulted in nearly 6k user accounts and over 220k private messages between forum members being exposed.
AT&T ()
Breach date: 2021-08-20
Accounts affected: 49102176
Data exposed: Dates of birth, Email addresses, Government issued IDs, Names, Phone numbers, Physical addresses
In March 2024, tens of millions of records allegedly breached from AT&T were posted to a popular hacking forum. Dating back to August 2021, the data was originally posted for sale before later being freely released. At the time, AT&T maintained that there had not been a breach of their systems and that the data originated from elsewhere. 12 days later, AT&T acknowledged that data fields specific to them were in the breach and that it was not yet known whether the breach occurred at their end or that of a vendor. AT&T also proceeded to reset customer account passcodes, an indicator that there was sufficient belief passcodes had been compromised. The incident exposed names, email and physical addresses, dates of birth, phone numbers and US social security numbers.
Aternos (aternos.org)
Breach date: 2015-12-06
Accounts affected: 1436486
Data exposed: Email addresses, IP addresses, Passwords, Usernames, Website activity
In December 2015, the service for creating and running free Minecraft servers known as Aternos suffered a data breach that impacted 1.4 million subscribers. The data included usernames, email and IP addresses and hashed passwords.
Atlas Quantum (atlasquantum.com)
Breach date: 2018-08-25
Accounts affected: 261463
Data exposed: Account balances, Email addresses, Names, Phone numbers
In August 2018, the cryptocurrency investment platform Atlas Quantum suffered a data breach. The breach leaked the personal data of 261k investors on the platform including their names, phone numbers, email addresses and account balances.
Atmeltomo (atmeltomo.com)
Breach date: 2021-04-16
Accounts affected: 580177
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In April 2021, "Japan's largest e-mail friend search site" Atmeltomo suffered a data breach that was later sold on a popular hacking forum. The breach exposed 1.3M records with 580k unique email addresses along with usernames, IP addresses and unsalted MD5 password hashes.
Audi (audiusa.com)
Breach date: 2019-08-14
Accounts affected: 2743539
Data exposed: Dates of birth, Driver's licenses, Email addresses, Names, Phone numbers, Physical addresses, Social security numbers, Vehicle details
In August 2019, Audi USA suffered a data breach after a vendor left data unsecured and exposed on the internet. The data contained 2.7M unique email addresses along with names, phone numbers, physical addresses and vehicle information including VIN. In a disclosure statement from Audi, they also advised some customers had driver's licenses, dates of birth, social security numbers and other personal information exposed.
Aura (aura.com)
Breach date: 2026-03-06
Accounts affected: 903080
Data exposed: Customer service comments, Email addresses, IP addresses, Names, Phone numbers, Physical addresses
In March 2026, the online safety service Aura disclosed a data breach that exposed 900k unique email addresses. The data was primarily associated with a marketing tool from a previously acquired company, with fewer than 20k active Aura customers affected. Exposed data included names, phone numbers, physical and IP addresses, and customer service notes. Aura advised that no Social Security numbers, passwords or financial information were compromised.
Autocentrum.pl (autocentrum.pl)
Breach date: 2018-02-04
Accounts affected: 143717
Data exposed: Email addresses, Passwords
In February 2018, data belonging to the Polish motoring website autocentrum.pl was found online. The data contained 144k email addresses and plain text passwords.
AUTOSUR (autosur.fr)
Breach date: 2025-03-16
Accounts affected: 487226
Data exposed: Email addresses, Names, Phone numbers, Physical addresses, Vehicle details, Vehicle identification numbers (VINs), Vehicle registration plates
In March 2025, the French vehicle inspection company AUTOSUR suffered a data breach exposing over 10M customer records, though only 487k unique email addresses were present. The compromised data included names, phone numbers, physical addresses, and vehicle details such as make and model, VIN, and registration plate. AUTOSUR later issued a disclosure notice with further details.
Autotrader (autotrader.com)
Breach date: 2023-01-06
Accounts affected: 20032
Data exposed: Email addresses, Phone numbers, Physical addresses, Vehicle details, Vehicle identification numbers (VINs)
In January 2023, 1.4M records from the Autotrader online vehicle marketplace appeared on a popular hacking forum. Autotrader stated that the "data in question relates to aged listing data that was generally publicly available on our site at the time and open to automated collection methods". The data contained 20k unique email addresses alongside physical addresses and phone numbers of dealers and vehicle details including VIN numbers.
Avast (avast.com)
Breach date: 2014-05-26
Accounts affected: 422959
Data exposed: Email addresses, Passwords, Usernames
In May 2014, the Avast anti-virus forum was hacked and 423k member records were exposed. The Simple Machines Based forum included usernames, emails and password hashes.
Avito (avito.ma)
Breach date: 2022-11-18
Accounts affected: 2721835
Data exposed: Email addresses, Geographic locations, IP addresses, Names, Phone numbers
In November 2022, the Moroccan e-commerce service Avito suffered a data breach that exposed the personal information of 2.7M customers. The data included name, email, phone, IP address and geographic location.
Avvo (avvo.com)
Breach date: 2019-12-17
Accounts affected: 4101101
Data exposed: Email addresses, Passwords
In approximately December 2019, an alleged data breach of the lawyer directory service Avvo was published to an online hacking forum and used in an extortion scam (it's possible the exposure dates back earlier than that). The data contained 4.1M unique email addresses alongside SHA-1 hashes, most likely representing user passwords. Multiple attempts at contacting Avvo over the course of a week were unsuccessful and the authenticity of the data was eventually verified with common Avvo and HIBP subscribers.
B2B USA Businesses ()
Breach date: 2017-07-18
Accounts affected: 105059554
Data exposed: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses
In mid-2017, a spam list of over 105 million individuals in corporate America was discovered online. Referred to as "B2B USA Businesses", the list categorised email addresses by employer, providing information on individuals' job titles plus their work phone numbers and physical addresses. Read more about spam lists in HIBP.
Baby Names (babynames.com)
Breach date: 2008-10-24
Accounts affected: 846742
Data exposed: Email addresses, Passwords
In approximately 2008, the site to help parents name their children known as Baby Names suffered a data breach. The incident exposed 846k email addresses and passwords stored as salted MD5 hashes. When contacted in October 2018, Baby Names advised that "the breach happened at least ten years ago" and that members were notified at the time.
Badoo (badoo.com)
Breach date: 2013-06-01
Accounts affected: 112005531
Data exposed: Dates of birth, Email addresses, Genders, Names, Passwords, Usernames
In June 2016, a data breach allegedly originating from the social website Badoo was found to be circulating amongst traders. Likely obtained several years earlier, the data contained 112 million unique email addresses with personal data including names, birthdates and passwords stored as MD5 hashes. Whilst there are many indicators suggesting Badoo did indeed suffer a data breach, the legitimacy of the data could not be emphatically proven so this breach has been categorised as "unverified".
BannerBit (bannerbit.com)
Breach date: 2018-12-29
Accounts affected: 213415
Data exposed: Email addresses, Passwords
In approximately December 2018, the online ad platform BannerBit suffered a data breach. Containing 213k unique email addresses and plain text passwords, the data was provided to HIBP by a third party. Multiple attempts were made to contact BannerBit, but no response was received.
Banorte (banorte.com)
Breach date: 2014-08-18
Accounts affected: 2107000
Data exposed: Account balances, Email addresses, Genders, Government issued IDs, Names, Phone numbers, Physical addresses
In August 2022, millions of records from Mexican bank "Banorte" were publicly dumped on a popular hacking forum including 2.1M unique email addresses, physical addresses, names, phone numbers, RFC (tax) numbers, genders and bank balances. Banorte have stated that the data is "outdated", although have not yet indicated how far back it dates to. Anecdotal feedback from HIBP subscribers suggests the data may date back 8 years to 2014.
Battlefield Heroes (battlefieldheroes.com)
Breach date: 2011-06-26
Accounts affected: 530270
Data exposed: Passwords, Usernames
In June 2011 as part of a final breached data dump, the hacker collective "LulzSec" obtained and released over half a million usernames and passwords from the game Battlefield Heroes. The passwords were stored as MD5 hashes with no salt and many were easily converted back to their plain text versions.
Battlefy (battlefy.com)
Breach date: 2016-01-11
Accounts affected: 83610
Data exposed: Email addresses, Passwords, Usernames
In January 2016, the esports website Battlefy suffered a data breach that exposed 83k customer records. The impacted data included email addresses, usernames and passwords stored as bcrypt hashes.
Baydöner (baydoner.com)
Breach date: 2026-03-08
Accounts affected: 1266822
Data exposed: Dates of birth, Email addresses, Genders, Geographic locations, Government issued IDs, Names, Passwords, Phone numbers, Purchases
In March 2026, the Turkish restaurant chain Baydöner suffered a data breach which was subsequently published to a public hacking forum. The incident exposed over 1.2M unique email addresses along with names, phone numbers, cities of residence and plaintext passwords. A small number of records also included Turkish national ID number and date of birth. In their disclosure notice, Baydöner stated that payment and financial data was not affected.
Beautiful People (beautifulpeople.com)
Breach date: 2015-11-11
Accounts affected: 1100089
Data exposed: Beauty ratings, Car ownership statuses, Dates of birth, Drinking habits, Education levels, Email addresses, Genders, Geographic locations, Home ownership statuses, Income levels, IP addresses, Job titles, Names, Passwords, Personal descriptions, Personal interests, Physical attributes, Sexual orientations, Smoking habits, Website activity
In November 2015, the dating website Beautiful People was hacked and over 1.1M accounts were leaked. The data was being traded in underground circles and included a huge amount of personal information related to dating.
Beckett Collectibles (beckett.com)
Breach date: 2025-11-09
Accounts affected: 1041238
Data exposed: Email addresses, Names, Phone numbers, Physical addresses, Usernames
In November 2025, Beckett Collectibles experienced a data breach accompanied by website content defacement. The stolen data was later advertised for sale on a prominent hacking forum, with portions subsequently released publicly. The publicly circulating data initially included more than 500k email addresses reportedly belonging to North American customers, before a larger corpus of over 1M addresses was published the following month. The impacted data included names, usernames, phone numbers and physical addresses.