Tiago2024180/eyewebdataset huggingface dataset:
Eurofiber (eurofiber.com)
Breach date: 2025-11-13
Accounts affected: 10003
Data exposed: Email addresses, Names, Phone numbers
In November 2025, Eurofiber France disclosed a data breach of its ticket management platform. Data containing 10k unique email addresses and a smaller number of names and phone numbers was subsequently leaked. A threat actor claiming responsibility for the breach alleges to have additional, more sensitive data including screenshots, VPN configuration files, credentials, source code, certificates, archives, and SQL backup files.
europa.jobs (europa.jobs)
Breach date: 2019-08-11
Accounts affected: 226095
Data exposed: Dates of birth, Email addresses, Geographic locations, Job applications, Names, Passwords, Phone numbers, Spoken languages
In August 2019, the now defunct European jobs website europa.jobs (Google cache link) suffered a data breach. The incident exposed 226k unique email addresses alongside extensive personal information including names, dates of birth, job applications and passwords. The data was subsequently redistributed on a popular hacking forum.
Evermotion (evermotion.org)
Breach date: 2015-05-07
Accounts affected: 435510
Data exposed: Dates of birth, Email addresses, Passwords, Usernames
In May 2015, the Polish 3D modelling website known as Evermotion suffered a data breach resulting in the exposure of 435k unique user records. The data was sourced from a vBulletin forum and contained email addresses, usernames, dates of birth and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory.
Everybody Edits (everybodyedits.com)
Breach date: 2019-03-23
Accounts affected: 871190
Data exposed: Email addresses, IP addresses, Usernames
In March 2019, the multiplayer platform game Everybody Edits suffered a data breach. The incident exposed 871k unique email addresses alongside usernames and IP addresses. The data was subsequently distributed online across a collection of files.
Evite (evite.com)
Breach date: 2013-08-11
Accounts affected: 100985047
Data exposed: Dates of birth, Email addresses, Genders, Names, Passwords, Phone numbers, Physical addresses
In April 2019, the social planning website for managing online invitations Evite identified a data breach of their systems. Upon investigation, they found unauthorised access to a database archive dating back to 2013. The exposed data included a total of 101 million unique email addresses, most belonging to recipients of invitations. Members of the service also had names, phone numbers, physical addresses, dates of birth, genders and passwords stored in plain text exposed.
Evony (evony.com)
Breach date: 2016-06-01
Accounts affected: 29396116
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In June 2016, the online multiplayer game Evony was hacked and over 29 million unique accounts were exposed. The attack led to the exposure of usernames, email and IP addresses and MD5 hashes of passwords (without salt).
Exactis (exactis.com)
Breach date: 2018-06-01
Accounts affected: 131577763
Data exposed: Credit status information, Dates of birth, Education levels, Email addresses, Ethnicities, Family structure, Financial investments, Genders, Home ownership statuses, Income levels, IP addresses, Marital statuses, Names, Net worths, Occupations, Personal interests, Phone numbers, Physical addresses, Religions, Spoken languages
In June 2018, the marketing firm Exactis inadvertently publicly leaked 340 million records of personal data. Security researcher Vinny Troia of Night Lion Security discovered the leak contained multiple terabytes of personal information spread across hundreds of separate fields including addresses, phone numbers, family structures and extensive profiling data. The data was collected as part of Exactis' service as a "compiler and aggregator of premium business & consumer data" which they then sell for profiling and marketing purposes. A small subset of the exposed fields were provided to Have I Been Pwned and contained 132 million unique email addresses.
Experian (2015) (experian.com)
Breach date: 2015-09-16
Accounts affected: 7196890
Data exposed: Credit status information, Dates of birth, Email addresses, Ethnicities, Family structure, Genders, Home ownership statuses, Income levels, IP addresses, Names, Phone numbers, Physical addresses, Purchasing habits
In September 2015, the US based credit bureau and consumer data broker Experian suffered a data breach that impacted 15 million customers who had applied for financing from T-Mobile. An alleged data breach was subsequently circulated containing personal information including names, physical and email addresses, birth dates and various other personal attributes. Multiple Have I Been Pwned subscribers verified portions of the data as being accurate, but the actual source of it was inconclusive therefor this breach has been flagged as "unverified".
Experian (South Africa) ()
Breach date: 2020-08-19
Accounts affected: 1284637
Data exposed: Email addresses, Employers, Government issued IDs, Names, Occupations, Phone numbers
In August 2020, Experian South Africa suffered a data breach which exposed the personal information of tens of millions of individuals. Only 1.3M of the records contained email addresses, whilst most contained government issued identity numbers, names, addresses, occupations and employers, amongst other person information.
Exploit.In ()
Breach date: 2016-10-13
Accounts affected: 593427119
Data exposed: Email addresses, Passwords
In late 2016, a huge list of email address and password pairs appeared in a "combo list" referred to as "Exploit.In". The list contained 593 million unique email addresses, many with multiple different passwords hacked from various online systems. The list was broadly circulated and used for "credential stuffing", that is attackers employ it in an attempt to identify other online systems where the account owner had reused their password. For detailed background on this incident, read Password reuse, credential stuffing and another billion records in Have I Been Pwned.
Explore Talent (August 2024) (exploretalent.com)
Breach date: 2024-08-15
Accounts affected: 8929384
Data exposed: Email addresses
In August 2024, a slew of security vulnerabilities were identified with a conglomerate of online services which included the talent network Explore Talent. A vulnerable API exposed the personal records of 11.4M users of the service of which 8.9M unique email addresses were provided to HIBP. This incident is separate to the Explore Talent breach which occurred in 2022 and was loaded into HIBP in July 2024.
Explore Talent (July 2024) (exploretalent.com)
Breach date: 2022-02-28
Accounts affected: 5371574
Data exposed: Email addresses, Names, Phone numbers, Physical addresses
In July 2024, a data breach attributed to Explore Talent was publicly posted to a popular hacking forum. Containing 5.7M rows with 5.4M unique email addresses, the incident has been described by various sources as occurring between early 2022 to 2023 and also contains names, phone numbers and physical addresses.
Exposed VINs ()
Breach date: 2017-06-05
Accounts affected: 396650
Data exposed: Dates of birth, Email addresses, Family structure, Genders, Names, Phone numbers, Physical addresses, Vehicle details
In June 2017, an unsecured database with more than 10 million VINs (vehicle identification numbers) was discovered by researchers. Believed to be sourced from US car dealerships, the data included a raft of personal information and vehicle data along with 397k unique email addresses.
Exvagos (exvagos.org)
Breach date: 2022-07-21
Accounts affected: 2121789
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames
In July 2022, the direct download website Exvagos suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed 2.1M unique email addresses along with IP addresses, usernames, dates of birth and MD5 password hashes.
Eye4Fraud (eye4fraud.com)
Breach date: 2023-01-25
Accounts affected: 16000591
Data exposed: Email addresses, IP addresses, Names, Partial credit card data, Passwords, Phone numbers, Physical addresses
In February 2023, data alleged to have been taken from the fraud protection service Eye4Fraud was listed for sale on a popular hacking forum. Spanning tens of millions of rows with 16M unique email addresses, the data was spread across 147 tables totalling 65GB and included both direct users of the service and what appears to be individuals who'd placed orders on other services that implemented Eye4Fraud to protect their sales. The data included names and bcrypt password hashes for users, and names, phone numbers, physical addresses and partial credit card data (card type and last 4 digits) for orders placed using the service. Eye4Fraud did not respond to multiple attempts to report the incident.
EyeEm (eyeem.com)
Breach date: 2018-02-28
Accounts affected: 19611022
Data exposed: Bios, Email addresses, Names, Passwords, Usernames
In February 2018, photography website EyeEm suffered a data breach. The breach was identified among a collection of other large incidents and exposed almost 20M unique email addresses, names, usernames, bios and password hashes.
Facebook (facebook.com)
Breach date: 2019-08-01
Accounts affected: 509458528
Data exposed: Dates of birth, Email addresses, Employers, Genders, Geographic locations, Names, Phone numbers, Relationship statuses
In April 2021, a large data set of over 500 million Facebook users was made freely available for download. Encompassing approximately 20% of Facebook's subscribers, the data was allegedly obtained by exploiting a vulnerability Facebook advises they rectified in August 2019. The primary value of the data is the association of phone numbers to identities; whilst each record included phone, only 2.5 million contained an email address. Most records contained names and genders with many also including dates of birth, location, relationship status and employer.
Facebook Marketplace (facebook.com)
Breach date: 2023-10-01
Accounts affected: 77267
Data exposed: Email addresses, Geographic locations, Names, Passwords, Phone numbers, Social media profiles
In February 2024, 200k Facebook Marketplace records allegedly obtained from a Meta contractor in October 2023 were posted to a popular hacking forum. The data contained 77k unique email addresses alongside names, phone numbers, Facebook profile IDs and geographic locations. The data also contained bcrypt password hashes, although there is no indication these belong to the corresponding Facebook accounts.
Facepunch (facepunch.com)
Breach date: 2016-06-03
Accounts affected: 342913
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames
In June 2016, the game development studio Facepunch suffered a data breach that exposed 343k users. The breached data included usernames, email and IP addresses, dates of birth and salted MD5 password hashes. Facepunch advised they were aware of the incident and had notified people at the time. The data was provided to HIBP by whitehat security researcher and data analyst Adam Davies.
FaceUP (faceup.dk)
Breach date: 2013-01-01
Accounts affected: 87633
Data exposed: Dates of birth, Email addresses, Genders, Names, Passwords, Phone numbers, Usernames
In 2013, the Danish social media site FaceUP suffered a data breach. The incident exposed 87k unique email addresses alongside genders, dates of birth, names, phone numbers and passwords stored as unsalted MD5 hashes. When notified of the incident, FaceUP advised they had identified a SQL injection vulnerability at the time and forced password resets on impacted customers.
Factual (factual.com)
Breach date: 2017-03-22
Accounts affected: 2461696
Data exposed: Email addresses, Employers, Phone numbers, Physical addresses
In March 2017, a file containing 8M rows of data allegedly sourced from data aggregator Factual was compiled and later exchanged on the premise it was a "breach". The data contained 2.5M unique email addresses alongside business names, addresses and phone numbers. After consultation with Factual, they advised the data was "publicly available information about businesses and other points of interest that Factual makes available on its website and to customers".
Fair Vote Canada (fairvote.ca)
Breach date: 2024-03-02
Accounts affected: 134336
Data exposed: Email addresses, Names, Phone numbers, Physical addresses, Political donations
In March 2024, the Canadian national citizens' campaign for proportional representation Fair Vote Canada suffered a data breach. The incident was attributed to "a well-meaning volunteer" who inadvertently exposed data from 2020 which included 134k unique email addresses, names, physical addresses, phone numbers and, for some individuals, date and amount of a donation.
Famm (famm.us)
Breach date: 2020-10-08
Accounts affected: 535240
Data exposed: Dates of birth, Email addresses, Genders, Names, Passwords
In late 2020, the Japanese family photos website Famm suffered a data breach that subsequently exposed 1.3M customer records, including 535k unique email addresses. Impacted data also included names, dates of birth, genders and passwords stored as SHA-256 hashes.
Fanpass (fanpass.co.uk)
Breach date: 2022-04-30
Accounts affected: 112251
Data exposed: Email addresses, Genders, Names, Partial dates of birth, Passwords, Phone numbers, Physical addresses, Purchases, Social media profiles
In April 2022, the UK based website for buying and selling soccer tickets Fanpass suffered a data breach which exposed 112k customer records. Impacted data includes names, phone numbers, physical addresses, purchase histories and salted password hashes.
Fantasy Football Hub (fantasyfootballhub.co.uk)
Breach date: 2021-10-02
Accounts affected: 66479
Data exposed: Email addresses, IP addresses, Names, Passwords, Purchases, Usernames
In October 2021, the fantasy premier league (soccer) website Fantasy Football Hub suffered a data breach that exposed 66 thousand unique email addresses. The data included names, usernames, IP addresses, transactions and passwords stored as WordPress MD5 hashes.
Fashion Nexus (fashionnexus.co.uk)
Breach date: 2018-07-09
Accounts affected: 1279263
Data exposed: Browser user agent details, Dates of birth, Email addresses, Genders, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Purchases
In July 2018, UK-based ecommerce company Fashion Nexus suffered a data breach which exposed 1.4 million records. Multiple websites developed by sister company White Room Solutions were impacted in the breach amongst which were sites including Jaded London and AX Paris. The various sites exposed in the incident included a range of different data types including names, phone numbers, addresses and passwords stored as a mix of salted MD5 and SHA-1 as well as unsalted MD5 passwords. When asked by reporter Graham Cluley if a public statement on the incident was available, a one-word response of "No" was received.
FashionFantasyGame (fashionfantasygame.com)
Breach date: 2016-12-01
Accounts affected: 2357872
Data exposed: Email addresses, Passwords
In late 2016, the fashion gaming website Fashion Fantasy Game suffered a data breach. The incident exposed 2.3 million unique user accounts and corresponding MD5 password hashes with no salt. The data was contributed to Have I Been Pwned courtesy of rip@creep.im.
Fédération Francaise de Rugby (ffr.fr)
Breach date: 2023-07-06
Accounts affected: 281977
Data exposed: Dates of birth, Email addresses, Names, Phone numbers
In June 2023, the Fédération Francaise de Rugby (French Rugby Federation) suffered a data breach and attempted ransom. The breach exposed 282k unique email addresses along with names, dates of birth and phone numbers. The Federation subsequently published a disclosure notice and stated that the attack primarily affected email servers.
Figure (figure.com)
Breach date: 2026-01-28
Accounts affected: 967178
Data exposed: Dates of birth, Email addresses, Names, Phone numbers, Physical addresses
In February 2026, data obtained from the fintech lending platform Figure was publicly posted online. The exposed data, dating back to January 2026, contained over 900k unique email addresses along with names, phone numbers, physical addresses and dates of birth. Figure confirmed the incident and attributed it to a social engineering attack in which an employee was tricked into providing access.
Filmai.in (filmai.in)
Breach date: 2020-01-01
Accounts affected: 645786
Data exposed: Email addresses, Passwords, Usernames
In approximately 2019 or 2020, the Lithuanian movie streaming service Filmai.in suffered a data breach exposing 645k email addresses, usernames and plain text passwords.
Final Fantasy Shrine (ffshrine.org)
Breach date: 2015-09-18
Accounts affected: 620677
Data exposed: Email addresses, Passwords, Usernames, Website activity
In September 2015, the Final Fantasy discussion forum known as FFShrine was breached and the data dumped publicly. Approximately 620k records were released containing email addresses, IP addresses and salted hashes of passwords.
Finsure (finsure.com.au)
Breach date: 2024-10-15
Accounts affected: 296124
Data exposed: Email addresses, Names, Phone numbers, Physical addresses
In October 2024, almost 300k unique email addresses from Australian mortgage broking group Finsure were obtained from the ActivePipe real estate marketing platform. The impacted data also included names, phone numbers and physical addresses. The incident did not directly affect any of Finsure's systems or expose any passwords or financial data.
Fitmart (fitmart.de)
Breach date: 2021-10-01
Accounts affected: 214492
Data exposed: Email addresses, Passwords
In October 2021, data from the German fitness supplies store Fitmart was obtained and later redistributed online. The data included 214k unique email addresses accompanied by plain text passwords, allegedly "dehashed" from the original stored version.
Flash Flash Revolution (2016 breach) (flashflashrevolution.com)
Breach date: 2016-02-01
Accounts affected: 1771845
Data exposed: Email addresses, Passwords, Usernames
In February 2016, the music-based rhythm game known as Flash Flash Revolution was hacked and 1.8M accounts were exposed. Along with email and IP addresses, the vBulletin forum also exposed salted MD5 password hashes.
Flash Flash Revolution (2019 breach) (flashflashrevolution.com)
Breach date: 2019-07-16
Accounts affected: 1858124
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames
In July 2019, the music-based rhythm game Flash Flash Revolution suffered a data breach. The 2019 breach imapcted almost 1.9 million members and is in addition to the 2016 data breach of the same service. Email and IP addesses, usernames, dates of birth and salted MD5 hashes were all exposed in the breach. The data was provided with support from dehashed.com.
Flashback (flashback.se)
Breach date: 2015-02-11
Accounts affected: 40256
Data exposed: Email addresses, Government issued IDs, Physical addresses
In February 2015, the Swedish forum known as Flashback had sensitive internal data on 40k members published via the tabloid newspaper Aftonbladet. The data was allegedly sold to them via Researchgruppen (The Research Group) who have a history of exposing otherwise anonymous users, primarily those who they believe participate in "troll like" behaviour. The compromised data includes social security numbers, home and email addresses.
Flat Earth Sun, Moon and Zodiac App (flatearthdave.com)
Breach date: 2024-10-15
Accounts affected: 33294
Data exposed: Dates of birth, Email addresses, Genders, Geographic locations, Names, Passwords, Usernames
In October 2024, the flat earth sun, moon and zodiac app created by Flat Earth Dave was found to be leaking extensive personal information of its users. The data included 33k unique email addresses along with usernames, latitudes and longitudes (their position on the globe) and passwords stored in plain text. A small number of profiles also contained names, dates of birth and genders.
FlexBooker (flexbooker.com)
Breach date: 2021-12-23
Accounts affected: 3756794
Data exposed: Email addresses, Names, Partial credit card data, Passwords, Phone numbers
In December 2021, the online booking service FlexBooker suffered a data breach that exposed 3.7 million accounts. The data included email addresses, names, phone numbers and for a small number of accounts, password hashes and partial credit card data. FlexBooker has identified the breach as originating from a compromised account within their AWS infrastructure. The data was found being actively traded on a popular hacking forum.
Fling (fling.com)
Breach date: 2011-03-10
Accounts affected: 40767652
Data exposed: Dates of birth, Email addresses, Genders, Geographic locations, IP addresses, Passwords, Phone numbers, Sexual fetishes, Sexual orientations, Usernames, Website activity
In 2011, the self-proclaimed "World's Best Adult Social Network" website known as Fling was hacked and more than 40 million accounts obtained by the attacker. The breached data included highly sensitive personal attributes such as sexual orientation and sexual interests as well as email addresses and passwords stored in plain text.
FlipaClip (flipaclip.com)
Breach date: 2024-11-18
Accounts affected: 892854
Data exposed: Dates of birth, Email addresses, Geographic locations, Names
In November 2024, the animation app FlipaClip suffered a data breach that exposed almost 900k records due to an exposed Firebase server. The impacted data included name, email address, country and date of birth. FlipaClip advised the issue has since been rectified.
Florida Virtual School (flvs.net)
Breach date: 2018-02-12
Accounts affected: 542902
Data exposed: Dates of birth, Email addresses, Names, Passwords, School grades (class levels), Usernames
In March 2018, the Florida Virtual School (FLVS) posted a data breach notification to their website. The school had identified a data breach which had occurred sometime between 6 May 2016 and 12 Feb 2018 and an XML file containing 368k student records was subsequently found circulating. Each record contained student name, date of birth, password, grade, email and parent email resulting in a total of 543k unique email addresses. Due to the prevalence of email addresses belonging to individuals who are still legally children, the data breach has been flagged as "sensitive".
FNTECH (fntech.com)
Breach date: 2024-07-04
Accounts affected: 10386
Data exposed: Email addresses, IP addresses, Names
In July 2024, the events management platform FNTECH suffered a data breach that exposed 10k unique email addresses. The data contained registrants from various events, including participants of the Roblox Developer Conference registration list. The data also included names and IP addresses.
Foodora (foodora.com)
Breach date: 2016-04-22
Accounts affected: 582578
Data exposed: Email addresses, Names, Passwords, Phone numbers, Physical addresses
In April 2016, the online food delivery service Foodora suffered a data breach which was then extensively redistributed online. The breach included the personal information of hundreds of thousands of customers from multiple countries including their names, delivery addresses, phone numbers and passwords stored as either a salted MD5 or a bcrypt hash.
Forbes (forbes.com)
Breach date: 2014-02-15
Accounts affected: 1057819
Data exposed: Email addresses, Passwords, User website URLs, Usernames
In February 2014, the Forbes website succumbed to an attack that leaked over 1 million user accounts. The attack was attributed to the Syrian Electronic Army, allegedly as retribution for a perceived "Hate of Syria". The attack not only leaked user credentials, but also resulted in the posting of fake news stories to forbes.com.
ForumCommunity (forumcommunity.net)
Breach date: 2016-06-01
Accounts affected: 776648
Data exposed: Email addresses, Passwords, Usernames
In approximately mid-2016, the Italian-based service for creating forums known as ForumCommunity suffered a data breach. The incident impacted over 776k unique email addresses along with usernames and unsalted MD5 password hashes. No response was received from ForumCommunity when contacted.