Tiago2024180/eyewebdataset huggingface dataset:
CafePress (cafepress.com)
Breach date: 2019-02-20
Accounts affected: 23205290
Data exposed: Email addresses, Names, Passwords, Phone numbers, Physical addresses
In February 2019, the custom merchandise retailer CafePress suffered a data breach. The exposed data included 23 million unique email addresses with some records also containing names, physical addresses, phone numbers and passwords stored as SHA-1 hashes.
Canada Goose (canadagoose.com)
Breach date: 2025-07-04
Accounts affected: 581877
Data exposed: Device information, Email addresses, IP addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases
In February 2026, a data breach allegedly containing data relating to Canada Goose customers was published publicly. The data contained 920k records with 582k unique email addresses and included names, phone numbers, IP addresses, physical addresses and partial credit card data, specifically card type and last 4 digits. Canada Goose advised that the data "appears to relate to past customer transactions" and stated that it originated from a breach at a third party in August 2025. The most recent transaction date in the data is July 2025.
Canadian Tire (canadiantire.ca)
Breach date: 2025-10-02
Accounts affected: 38306562
Data exposed: Dates of birth, Email addresses, Genders, Names, Partial credit card data, Passwords, Phone numbers, Physical addresses
In October 2025, retailer Canadian Tire was the victim of a data breach that exposed almost 42M records. The data contained 38M unique email addresses along with names, phone numbers and physical addresses. Passwords were stored as PBKDF2 hashes and for a subset of records, dates of birth and partial credit card data were also included (card type, expiry and masked card number). In its disclosure notice, Canadian Tire advised that the incident did not impact bank account information or loyalty program data.
Cannabis.com (cannabis.com)
Breach date: 2014-02-05
Accounts affected: 227746
Data exposed: Dates of birth, Email addresses, Geographic locations, Historical passwords, Instant messenger identities, IP addresses, Passwords, Private messages, Usernames, Website activity
In February 2014, the vBulletin forum for the Marijuana site cannabis.com was breached and leaked publicly. Whilst there has been no public attribution of the breach, the leaked data included over 227k accounts and nearly 10k private messages between users of the forum.
Canva (canva.com)
Breach date: 2019-05-24
Accounts affected: 137272116
Data exposed: Email addresses, Geographic locations, Names, Passwords, Usernames
In May 2019, the graphic design tool website Canva suffered a data breach that impacted 137 million subscribers. The exposed data included email addresses, usernames, names, cities of residence and passwords stored as bcrypt hashes for users not using social logins.
Capital Economics (capitaleconomics.com)
Breach date: 2020-12-12
Accounts affected: 263829
Data exposed: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses
In December 2020, the economic research company Capital Economics suffered a data breach that exposed 263k customer records. The exposed data included email and physical addresses, names, phone numbers, job titles and the employer of impacted customers.
Carding Mafia (December 2021) (cardmafia.cc)
Breach date: 2021-12-28
Accounts affected: 303877
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In December 2021, the Carding Mafia forum suffered a data breach that exposed over 300k members' email addresses. Dedicated to the theft and trading of stolen credit cards, the forum breach also exposed usernames, IP addresses and passwords stored as salted MD5 hashes. This breach came only 9 months after another breach of the forum in March 2021.
Carding Mafia (March 2021) (cardmafia.cc)
Breach date: 2021-03-18
Accounts affected: 297744
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In March 2021, the Carding Mafia forum suffered a data breach that exposed almost 300k members' email addresses. Dedicated to the theft and trading of stolen credit cards, the forum breach also exposed usernames, IP addresses and passwords stored as salted MD5 hashes.
CarGurus (cargurus.com)
Breach date: 2026-02-14
Accounts affected: 12461887
Data exposed: Email addresses, IP addresses, Names, Phone numbers, Physical addresses
In February 2026, the automotive marketplace CarGurus was the target of a data breach attributed to the threat actor ShinyHunters. Following an attempted extortion, the data was published publicly and contained more than 12M email addresses across multiple files including user account ID mappings, finance pre-qualification application data and dealer account and subscription information. Impacted data also included names, phone numbers, physical and IP addresses, and auto finance application outcomes.
CarMax (carmax.com)
Breach date: 2026-01-24
Accounts affected: 431371
Data exposed: Email addresses, Names, Phone numbers, Physical addresses
In January 2026, data allegedly sourced from US automotive retailer CarMax was published online following a failed extortion attempt. The data included 431k unique email addresses along with names, phone numbers and physical addresses.
CashCrate (cashcrate.com)
Breach date: 2016-11-17
Accounts affected: 6844490
Data exposed: Email addresses, Names, Passwords, Physical addresses
In June 2017, news broke that CashCrate had suffered a data breach exposing 6.8 million records. The breach of the cash-for-surveys site dated back to November 2016 and exposed names, physical addresses, email addresses and passwords stored in plain text for older accounts along with weak MD5 hashes for newer ones.
Catho (catho.com.br)
Breach date: 2020-03-01
Accounts affected: 1173012
Data exposed: Email addresses, Names, Passwords, Usernames
In approximately March 2020, the Brazilian recruitment website Catho was compromised and subsequently appeared alongside 20 other breached websites listed for sale on a dark web marketplace. The breach included almost 11 million records with 1.2 million unique email addresses. Names, usernames and plain text passwords were also exposed. The data was provided to HIBP by breachbase.pw.
Catwatchful (catwatchful.com)
Breach date: 2025-06-09
Accounts affected: 61641
Data exposed: Email addresses, Passwords
In June 2025, spyware maker Catwatchful suffered a data breach that exposed over 60k customer records. The breach was due to a SQL injection vulnerability that enabled email addresses and plain text passwords to be extracted from the system.
CD Projekt RED (cdprojektred.com)
Breach date: 2016-03-01
Accounts affected: 1871373
Data exposed: Email addresses, Passwords, Usernames
In March 2016, Polish game developer CD Projekt RED suffered a data breach. The hack of their forum led to the exposure of almost 1.9 million accounts along with usernames, email addresses and salted SHA1 passwords.
CDEK (cdek.ru)
Breach date: 2022-03-09
Accounts affected: 19218203
Data exposed: Email addresses, Names, Phone numbers
In early 2022, a collective known as IT Army whose stated goal is to "completely de-anonymise most Russian users by leaking hundreds of gigabytes of databases" published over 30GB of data allegedly sourced from Russian courier service CDEK. The data contained over 19M unique email addresses along with names and phone numbers. The authenticity of the breach could not be independently established and has been flagged as "unverified".
Central Tickets (centraltickets.co.uk)
Breach date: 2024-07-01
Accounts affected: 722860
Data exposed: Device information, Email addresses, IP addresses, Names, Passwords, Phone numbers, Purchases
In September 2024, data from the ticketing service Central Tickets was publicly posted to a hacking forum. The data suggests the breach occurred several months earlier and exposed 723k unique email addresses alongside names, phone numbers, IP addresses, purchases and passwords stored as unsalted SHA-1 hashes.
Chatbooks (chatbooks.com)
Breach date: 2020-03-26
Accounts affected: 2520441
Data exposed: Email addresses, Names, Passwords, Phone numbers, Social media profiles
In March 2020, the photo print service Chatbooks suffered a data breach which was subsequently put up for sale on a dark web marketplace. The breach contained 15 million user records with 2.5 million unique email addresses alongside names, phone numbers, social media profiles and salted SHA-512 password hashes. The data was provided to HIBP by dehashed.com.
CheapAssGamer.com (cheapassgamer.com)
Breach date: 2015-07-01
Accounts affected: 444767
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In approximately mid-2015, the forum for CheapAssGamer.com suffered a data breach. The database from the IP.Board based forum contained 445k accounts including usernames, email and IP addresses and salted MD5 password hashes.
Chegg (chegg.com)
Breach date: 2018-04-28
Accounts affected: 39721127
Data exposed: Email addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
In April 2018, the textbook rental service Chegg suffered a data breach that impacted 40 million subscribers. The exposed data included email addresses, usernames, names and passwords stored as unsalted MD5 hashes. A small number of records also contained physical address or phone number.
Chess (chess.com)
Breach date: 2023-11-08
Accounts affected: 1274077
Data exposed: Email addresses, Geographic locations, Names, Usernames
In November 2023, over 800k user records were scraped from the Chess website and posted to a popular hacking forum. The data included email address, name, username and the geographic location of the user. A further 446k scraped records were later provided and added to HIBP.
China Software Developer Network (csdn.net)
Breach date: 2011-12-21
Accounts affected: 6414990
Data exposed: Email addresses, Passwords, Usernames
In 2011, the China Software Developer Network (CSDN) suffered a data breach that exposed over 6M user records. The data included email addresses alongside usernames and plain text passwords.
Chowbus (chowbus.com)
Breach date: 2020-10-05
Accounts affected: 444224
Data exposed: Email addresses, Names, Phone numbers, Physical addresses
In October 2020, the Asian food delivery app Chowbus suffered a data breach which led to over 800,000 records being emailed to customers. The email contained a link to a CSV file with customer data including physical addresses, names, phone numbers and over 444,000 unique email addresses.
Chris Leong (chrisleong.com)
Breach date: 2024-08-10
Accounts affected: 27096
Data exposed: Dates of birth, Email addresses, Genders, Names, Nationalities, Phone numbers, Physical addresses, Purchases, Social media profiles
In August 2024, the website of Master Chris Leong "a leading Tit Tar practitioner in Malaysia" suffered a data breach. The incident exposed 27k unique email addresses along with names, physical addresses, dates of birth, genders, nationalities and in many cases, links to Facebook profiles. The company did not respond when contacted about the breach.
Cit0day (cit0day.in)
Breach date: 2020-11-04
Accounts affected: 226883414
Data exposed: Email addresses, Passwords
In November 2020, a collection of more than 23,000 allegedly breached websites known as Cit0day were made available for download on several hacking forums. The data consisted of 226M unique email address alongside password pairs, often represented as both password hashes and the cracked, plain text versions. Independent verification of the data established it contains many legitimate, previously undisclosed breaches. The data was provided to HIBP by dehashed.com.
CityBee (citybee.lt)
Breach date: 2021-02-05
Accounts affected: 110156
Data exposed: Email addresses, Government issued IDs, Names, Passwords
In February 2021, the Lithuanian car-sharing service CityBee announced they'd suffered a data breach that exposed 110k customers' personal information. The breach exposed names, email addresses, government issued IDs and passwords stored as unsalted SHA-1 hashes.
CityJerks (cityjerks.com)
Breach date: 2023-02-27
Accounts affected: 177554
Data exposed: Bios, Dates of birth, Email addresses, Geographic locations, IP addresses, Passwords, Private messages, Profile photos, Sexual orientations, Usernames
In early 2023, the "mutual masturbation" website CityJerks suffered a data breach that exposed 177k unique email addresses. The breach also included data from the TruckerSucker "dating app for REAL TRUCKERS and REAL MEN" with the combined corpus of data also exposing usernames, IP addresses, dates of birth, sexual orientations, geo locations, private messages between members and passwords stored as salted MD5 hashes. The data was subsequently listed on a public hacking site.
Civil Online (co188.com)
Breach date: 2011-07-10
Accounts affected: 7830195
Data exposed: Email addresses, IP addresses, Passwords, Usernames, Website activity
In mid-2011, data was allegedly obtained from the Chinese engineering website known as Civil Online and contained 7.8M accounts. Whilst there is evidence that the data is legitimate, due to the difficulty of emphatically verifying the Chinese breach it has been flagged as "unverified". The data in the breach contains email and IP addresses, user names and MD5 password hashes. Read more about Chinese data breaches in Have I Been Pwned.
Clash of Kings (f.elex.com)
Breach date: 2016-07-14
Accounts affected: 1604957
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In July 2016, the forum for the game "Clash of Kings" suffered a data breach that impacted 1.6 million subscribers. The impacted data included usernames, IP and email addresses and passwords stored as MD5 hashes. The data was provided to HIBP by dehashed.com.
ClearVoice Surveys (clearvoicesurveys.com)
Breach date: 2015-08-23
Accounts affected: 15074786
Data exposed: Dates of birth, Email addresses, Genders, IP addresses, Names, Passwords, Phone numbers, Physical addresses
In April 2021, the market research surveys company ClearVoice Surveys had a publicly facing database backup from 2015 taken and redistributed on a popular hacking forum. The data included 15M unique email addresses across more than 17M rows of data that also included names, physical and IP addresses, genders, dates of birth and plain text passwords. ClearVoice Surveys advised they were aware of the breach and confirmed its authenticity.
ClickASnap (clickasnap.com)
Breach date: 2022-09-24
Accounts affected: 3262980
Data exposed: Email addresses, Names, Passwords, Physical addresses, Purchases, Social media profiles, Usernames
In September 2022, the online photo sharing platform ClickASnap suffered a data breach. The incident exposed almost 3.3M personal records including email addresses, usernames and passwords stored as SHA-512 hashes. Further, a collection of paid subscriptions were also included and contained names, physical addresses and amounts paid.
ClixSense (clixsense.com)
Breach date: 2016-09-04
Accounts affected: 2424784
Data exposed: Account balances, Dates of birth, Email addresses, Genders, IP addresses, Names, Passwords, Payment histories, Payment methods, Physical addresses, Usernames, Website activity
In September 2016, the paid-to-click site ClixSense suffered a data breach which exposed 2.4 million subscriber identities. The breached data was then posted online by the attackers who claimed it was a subset of a larger data breach totalling 6.6 million records. The leaked data was extensive and included names, physical, email and IP addresses, genders and birth dates, account balances and passwords stored as plain text.
CloudPets (cloudpets.com)
Breach date: 2017-01-01
Accounts affected: 583503
Data exposed: Email addresses, Family members' names, Passwords
In January, the maker of teddy bears that record children's voices and sends them to family and friends via the internet CloudPets left their database publicly exposed and it was subsequently downloaded by external parties (the data was also subject to 3 different ransom demands). 583k records were provided to HIBP via a data trader and included email addresses and bcrypt hashes, but the full extent of user data exposed by the system was over 821k records and also included children's names and references to portrait photos and voice recordings.
Club Penguin Rewritten (January 2018) (cprewritten.net)
Breach date: 2018-01-21
Accounts affected: 1688176
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In January 2018, the children's gaming site Club Penguin Rewritten (CPRewritten) suffered a data breach (note: CPRewritten is an independent recreation of Disney's Club Penguin game). The incident exposed almost 1.7 million unique email addresses alongside IP addresses, usernames and passwords stored as bcrypt hashes. When contacted, CPRewritten advised they were aware of the breach and had "contacted affected users".
Club Penguin Rewritten (July 2019) (cprewritten.net)
Breach date: 2019-07-27
Accounts affected: 4007909
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In July 2019, the children's gaming site Club Penguin Rewritten (CPRewritten) suffered a data breach (note: CPRewritten is an independent recreation of Disney's Club Penguin game). In addition to an earlier data breach that impacted 1.7 million accounts, the subsequent breach exposed 4 million unique email addresses alongside IP addresses, usernames and passwords stored as bcrypt hashes.
Coachella (coachella.com)
Breach date: 2017-02-22
Accounts affected: 599802
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In February 2017, hundreds of thousands of records from the Coachella music festival were discovered being sold online. Allegedly taken from a combination of the main Coachella website and their vBulletin-based message board, the data included almost 600k usernames, IP and email addresses and salted hashes of passwords (MD5 in the case of the message board).
Cocospy (cocospy.com)
Breach date: 2025-02-14
Accounts affected: 1798059
Data exposed: Email addresses
In February 2025, the spyware service Cocospy suffered a data breach along with sibling spyware service, Spyic. The Cocospy breach alone exposed almost 1.8M customer email addresses which were provided to HIBP, and reportedly also enabled unauthorised access to captured messages, photos, call logs, and more.
CodeStepByStep (codestepbystep.com)
Breach date: 2025-11-15
Accounts affected: 103077
Data exposed: Email addresses, Names, Usernames
In November 2025, the online coding practice tool CodeStepByStep suffered a data breach that exposed 17k records which were subsequently published online. The following month, a further corpus of data was released bringing the total to 103k. The impacted data included names, usernames and email addresses.
Coinmama (coinmama.com)
Breach date: 2017-08-03
Accounts affected: 478824
Data exposed: Email addresses, Passwords, Usernames
In August 2017, the crypto coin brokerage service Coinmama suffered a data breach that impacted 479k subscribers. The breach was discovered in February 2019 with exposed data including email addresses, usernames and passwords stored as MD5 WordPress hashes. The data was provided to HIBP by white hat security researcher and data analyst Adam Davies.
CoinMarketCap (coinmarketcap.com)
Breach date: 2021-10-12
Accounts affected: 3117548
Data exposed: Email addresses
During October 2021, 3.1 million email addresses with accounts on the cryptocurrency market capitalisation website CoinMarketCap were discovered being traded on hacking forums. Whilst the email addresses were found to correlate with CoinMarketCap accounts, it's unclear precisely how they were obtained. CoinMarketCap has provided the following statement on the data: "CoinMarketCap has become aware that batches of data have shown up online purporting to be a list of user accounts. While the data lists we have seen are only email addresses (no passwords), we have found a correlation with our subscriber base. We have not found any evidence of a data leak from our own servers — we are actively investigating this issue and will update our subscribers as soon as we have any new information."
CoinTracker (cointracker.io)
Breach date: 2022-12-01
Accounts affected: 1557153
Data exposed: Email addresses, Partial phone numbers
In December 2022, the Crypto & NFT taxes service CoinTracker reported a data breach that impacted over 1.5M of their customers. The company later attributed the breach to a compromise SendGrid in an attack that targeted multiple customers of the email provider. The breach exposed email addresses and partially redacted phone numbers, with CoinTracker advising that the later did not originate from their service.
Collection #1 ()
Breach date: 2019-01-07
Accounts affected: 772904991
Data exposed: Email addresses, Passwords
In January 2019, a large collection of credential stuffing lists (combinations of email addresses and passwords used to hijack accounts on other services) was discovered being distributed on a popular hacking forum. The data contained almost 2.7 billion records including 773 million unique email addresses alongside passwords those addresses had used on other breached services. Full details on the incident and how to search the breached passwords are provided in the blog post The 773 Million Record "Collection #1" Data Breach.
ColoCrossing (colocrossing.com)
Breach date: 2025-05-24
Accounts affected: 7183
Data exposed: Email addresses, Names, Passwords
In May 2025, hosting provider ColoCrossing identified a data breach that impacted customers of their ColoCloud virtual server product. ColoCrossing advised the incident was isolated to their cloud/VPS platform and stemmed from a single sign-on vulnerability. 7k email addresses were exposed in the incident along with names and MD5-Crypt password hashes.
Color Dating (colordatingapp.com)
Breach date: 2018-09-05
Accounts affected: 220503
Data exposed: Bios, Dates of birth, Email addresses, Geographic locations, Names, Passwords, Profile photos
In September 2018, the dating app to match people with different ethnicities Color Dating suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed 220k unique email addresses along with bios, names, profile photos and bcrypt password hashes.
Combolists Posted to Telegram ()
Breach date: 2024-05-28
Accounts affected: 361468099
Data exposed: Email addresses, Passwords, Usernames
In May 2024, 2B rows of data with 361M unique email addresses were collated from malicious Telegram channels. The data contained 122GB across 1.7k files with email addresses, usernames, passwords and in many cases, the website they were entered into. The data appears to have been sourced from a combination of existing combolists and info stealer malware.
Comcast (comcast.net)
Breach date: 2015-11-08
Accounts affected: 616882
Data exposed: Email addresses, Passwords, Physical addresses
In November 2015, the US internet and cable TV provider Comcast suffered a data breach that exposed 590k customer email addresses and plain text passwords. A further 27k accounts appeared with home addresses with the entire data set being sold on underground forums.
COMELEC (Philippines Voters) (comelec.gov.ph)
Breach date: 2016-03-27
Accounts affected: 228605
Data exposed: Biometric data, Dates of birth, Email addresses, Family members' names, Genders, Job titles, Marital statuses, Names, Passport numbers, Phone numbers, Physical addresses, Physical attributes
In March 2016, the Philippines Commission of Elections website (COMELEC) was attacked and defaced, allegedly by Anonymous Philippines. Shortly after, data on 55 million Filipino voters was leaked publicly and included sensitive information such as genders, marital statuses, height and weight and biometric fingerprint data. The breach only included 228k email addresses.