Tiago2024180/eyewebdataset huggingface dataset:
Disk Union (diskunion.net)
Breach date: 2022-06-24
Accounts affected: 690667
Data exposed: Email addresses, Geographic locations, Names, Passwords, Phone numbers, Usernames
In June 2022, the Japanese record chain store Disk Union suffered a data breach. The incident exposed 690k unique email addresses along with names, post codes, phone numbers and plain text passwords.
Disqus (disqus.com)
Breach date: 2012-07-01
Accounts affected: 17551044
Data exposed: Email addresses, Passwords, Usernames
In October 2017, the blog commenting service Disqus announced they'd suffered a data breach. The breach dated back to July 2012 but wasn't identified until years later when the data finally surfaced. The breach contained over 17.5 million unique email addresses and usernames. Users who created logins on Disqus had salted SHA1 hashes of passwords whilst users who logged in via social providers only had references to those accounts.
Divine Skins (divineskins.gg)
Breach date: 2026-03-13
Accounts affected: 105814
Data exposed: Email addresses, Purchases, Usernames
In March 2026, the League of Legends custom skins service Divine Skins suffered a data breach. The incident was disclosed via the service's Discord server, where Divine Skins stated that an unauthorised third party accessed part of its systems, deleted all skins from the database and exposed email addresses and usernames. The data also contained a history of purchases made by users.
DivX SubTitles (divxsubtitles.net)
Breach date: 2010-01-01
Accounts affected: 783058
Data exposed: Email addresses, Passwords, Usernames
In approximately 2010, the now defunct website DivX SubTitles suffered a data breach that exposed 783k user accounts including email addresses, usernames and plain text passwords.
DLH.net (dlh.net)
Breach date: 2016-07-31
Accounts affected: 3264710
Data exposed: Dates of birth, Email addresses, Names, Passwords, Usernames, Website activity
In July 2016, the gaming news site DLH.net suffered a data breach which exposed 3.3M subscriber identities. Along with the keys used to redeem and activate games on the Steam platform, the breach also resulted in the exposure of email addresses, birth dates and salted MD5 password hashes. The data was donated to Have I Been Pwned by data breach monitoring service Vigilante.pw.
Dodonew.com (dodonew.com)
Breach date: 2011-12-01
Accounts affected: 8718404
Data exposed: Email addresses, Usernames
In late 2011, data was allegedly obtained from the Chinese website known as Dodonew.com and contained 8.7M accounts. Whilst there is evidence that the data is legitimate, due to the difficulty of emphatically verifying the Chinese breach it has been flagged as "unverified". The data in the breach contains email addresses and user names. Read more about Chinese data breaches in Have I Been Pwned.
Domino's (pizza.dominos.be)
Breach date: 2014-06-13
Accounts affected: 648231
Data exposed: Email addresses, Names, Passwords, Phone numbers, Physical addresses
In June 2014, Domino's Pizza in France and Belgium was hacked by a group going by the name "Rex Mundi" and their customer data held to ransom. Domino's refused to pay the ransom and six months later, the attackers released the data along with troves of other hacked accounts. Amongst the customer data was passwords stored with a weak MD5 hashing algorithm and no salt.
Domino's India (dominos.co.in)
Breach date: 2021-03-24
Accounts affected: 22527655
Data exposed: Email addresses, Names, Phone numbers, Physical addresses, Purchases
In April 2021, 13TB of compromised Domino's India appeared for sale on a hacking forum after which the company acknowledged a major data breach they dated back to March. The compromised data included 22.5 million unique email addresses, names, phone numbers, order histories and physical addresses.
Doomworld (doomworld.com)
Breach date: 2022-10-12
Accounts affected: 34478
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In October 2022, the Doomworld fourm suffered a data breach that exposed 34k member records. The data included email and IP addresses, usernames and bcrypt password hashes.
DoorDash (doordash.com)
Breach date: 2022-08-02
Accounts affected: 367476
Data exposed: Email addresses, Geographic locations, Names, Partial credit card data
In August 2022, the food ordering and delivery service DoorDash disclosed a data breach that impacted a portion of their customers. DoorDash attributed the breach to an unnamed "third-party vendor" they stated was the victim of a phishing campaign. The incident exposed 367k unique personal email addresses alongside names, post codes and partial card data, namely the brand, expiry data and last four digits of the card.
Dota2 (dev.dota2.com)
Breach date: 2016-07-10
Accounts affected: 1907205
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In July 2016, the Dota2 official developers forum suffered a data breach that exposed almost 2 million users. The hack of the vBulletin forum led to the disclosure of email and IP addresses, usernames and passwords stored as salted MD5 hashes.
Doxbin (doxbin.com)
Breach date: 2022-01-05
Accounts affected: 370794
Data exposed: Browser user agent details, Email addresses, Passwords, Usernames
In January 2022, the "doxing" website designed to disclose the personal information of targeted individuals ("doxes") Doxbin suffered a data breach. The breach was subsequently leaked online and included over 370k unique email addresses across user accounts and doxes. User accounts also included usernames, password hashes and browser user agents. The personal information disclosed in the doxes was often extensive including names, physical addresses, phone numbers and more.
Doxbin (TOoDA) (doxbin.com)
Breach date: 2024-02-12
Accounts affected: 136461
Data exposed: Email addresses, Usernames
In February 2025, the "doxing" website Doxbin was compromised by a group calling themselves "TOoDA" and the data dumped publicly. Included in the breach were 336k unique email addresses alongside usernames.
Doxbin Scrape (doxbin.com)
Breach date: 2025-01-24
Accounts affected: 435784
Data exposed: Email addresses
In January 2025, 435k email addresses were scraped from the "doxing" service Doxbin. Posts to the service are usually intended to disclose the personal information of non-consensually third parties.
DragonNest (dragonnest.com)
Breach date: 2013-08-23
Accounts affected: 511290
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In August 2013, the massively multiplayer online role-playing game (MMORGP) DragonNest suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed over 500k unique email addresses along with usernames, IP addresses and plain text passwords. The service later suffered a massive data loss.
DriveSure (drivesure.com)
Breach date: 2020-12-19
Accounts affected: 3675099
Data exposed: Email addresses, Names, Passwords, Phone numbers, Physical addresses, Vehicle details
In December 2020, the car dealership service provider DriveSure suffered a data breach. The incident resulted in 26GB of data being downloaded and later shared on a hacking forum. Impacted personal information included 3.6 million unique email addresses, names, phone numbers and physical addresses. Vehicle data was also exposed and included makes, models, VIN numbers and odometer readings. A small number of passwords stored as bcrypt hashes were also included in the data set.
Drizly (drizly.com)
Breach date: 2020-07-02
Accounts affected: 2479044
Data exposed: Dates of birth, Device information, Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses
In approximately July 2020, the US-based online alcohol delivery service Drizly suffered a data breach. The data was sold online before being extensively redistributed and contained 2.5 million unique email addresses alongside names, physical and IP addresses, phone numbers, dates of birth and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
Dropbox (dropbox.com)
Breach date: 2012-07-01
Accounts affected: 68648009
Data exposed: Email addresses, Passwords
In mid-2012, Dropbox suffered a data breach which exposed the stored credentials of tens of millions of their customers. In August 2016, they forced password resets for customers they believed may be at risk. A large volume of data totalling over 68 million records was subsequently traded online and included email addresses and salted hashes of passwords (half of them SHA1, half of them bcrypt).
Dubsmash (dubsmash.com)
Breach date: 2018-12-01
Accounts affected: 161749950
Data exposed: Email addresses, Geographic locations, Names, Passwords, Phone numbers, Spoken languages, Usernames
In December 2018, the video messaging service Dubsmash suffered a data breach. The incident exposed 162 million unique email addresses alongside usernames and PBKDF2 password hashes. In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly.
Ducks Unlimited (ducks.org)
Breach date: 2021-01-29
Accounts affected: 1324364
Data exposed: Dates of birth, Email addresses, Names, Passwords, Phone numbers, Physical addresses
In mid-2021, Risk Based Security reported on a database sourced from Ducks Unlimited being traded online. The data dated back to January 2021 and contained 1.3M unique email addresses across both a membership list and a list of website users. Impacted data included names, phones numbers, physical addresses, dates of birth and passwords stored as unsalted MD5 hashes.
Dueling Network (duelingnetwork.com)
Breach date: 2017-03-29
Accounts affected: 6486626
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In March 2017, the Flash game based on the Yu-Gi-Oh trading card game Dueling Network suffered a data breach. The site itself was taken offline in 2016 due to a cease-and-desist order but the forum remained online for another year. The data breach exposed usernames, IP and email addresses and passwords stored as MD5 hashes.
Dungeons & Dragons Online (ddo.com)
Breach date: 2013-04-02
Accounts affected: 1580933
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames, Website activity
In April 2013, the interactive video game Dungeons & Dragons Online suffered a data breach that exposed almost 1.6M players' accounts. The data was being actively traded on underground forums and included email addresses, birth dates and password hashes.
Dunzo (dunzo.com)
Breach date: 2020-06-19
Accounts affected: 3465259
Data exposed: Device information, Email addresses, Geographic locations, IP addresses, Names, Phone numbers
In approximately June 2019, the Indian delivery service Dunzo suffered a data breach. Exposing 3.5 million unique email addresses, the Dunzo breach also included names, phone numbers and IP addresses which were all broadly distributed online via a hacking forum. The data was provided to HIBP by dehashed.com.
Duolingo (duolingo.com)
Breach date: 2023-01-24
Accounts affected: 2676696
Data exposed: Email addresses, Names, Spoken languages, Usernames
In August 2023, 2.6M records of data scraped from Duolingo were broadly distributed on a popular hacking forum. Obtained by enumerating a vulnerable API, the data had earlier appeared for sale in January 2023 and contained email addresses, names, the languages being learned, XP (experience points), and other data related to learning progress on Duolingo. Whilst some of the data attributes are intentionally public, the ability to map private email addresses to them presents an ongoing risk to user privacy.
Duowan.com (duowan.com)
Breach date: 2011-01-01
Accounts affected: 2639894
Data exposed: Email addresses, Passwords, Usernames
In approximately 2011, data was allegedly obtained from the Chinese gaming website known as Duowan.com and contained 2.6M accounts. Whilst there is evidence that the data is legitimate, due to the difficulty of emphatically verifying the Chinese breach it has been flagged as "unverified". The data in the breach contains email addresses, user names and plain text passwords. Read more about Chinese data breaches in Have I Been Pwned.
dvd-shop.ch (dvd-shop.ch)
Breach date: 2017-12-05
Accounts affected: 67973
Data exposed: Email addresses, Passwords
In December 2017, the online Swiss DVD store known as dvd-shop.ch suffered a data breach. The incident led to the exposure of 68k email addresses and plain text passwords. The site has since been updated to indicate that it is currently closed.
Dymocks (dymocks.com.au)
Breach date: 2023-06-20
Accounts affected: 836120
Data exposed: Dates of birth, Email addresses, Genders, Names, Phone numbers, Physical addresses
In September 2023, the Australian book retailer Dymocks announced a data breach. The data dated back to June 2023 and contained 1.2M records with 836k unique email addresses. The breach also exposed names, dates of birth, genders, phone numbers and physical addresses.
Earth 2 (earth2.io)
Breach date: 2024-10-16
Accounts affected: 420961
Data exposed: Email addresses, Usernames
In October 2024, 421k unique email addresses from the virtual earth game Earth 2 were derived from embedded Gravatar images. Appearing alongside player usernames, the root cause was related to how Gravatar presents links to avatars as MD5 hashes within consuming services, a feature Earth 2 advised has now been disabled on their platform. This incident did not expose any further personal information, passwords or financial data.
Eatigo (eatigo.com)
Breach date: 2018-10-16
Accounts affected: 2789609
Data exposed: Email addresses, Genders, Names, Passwords, Phone numbers, Social media profiles
In October 2018, the restaurant reservation service Eatigo suffered a data breach that exposed 2.8 million accounts. The data included email addresses, names, phone numbers, social media profiles, genders and passwords stored as unsalted MD5 hashes.
EatStreet (eatstreet.com)
Breach date: 2019-05-03
Accounts affected: 6353564
Data exposed: Dates of birth, Email addresses, Genders, Names, Partial credit card data, Passwords, Phone numbers, Physical addresses, Social media profiles
In May 2019, the online food ordering service EatStreet suffered a data breach affecting 6.4 million customers. An extensive amount of personal data was obtained including names, phone numbers, addresses, partial credit card data and passwords stored as bcrypt hashes.
ECCIE (eccie.net)
Breach date: 2021-07-01
Accounts affected: 536923
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames
In January 2021, the adult escort forum ECCIE suffered a data breach which was later posted to a popular hacking forum. The data included 536k user records with email and IP addresses, usernames, dates of birth and salted MD5 password hashes.
Edmodo (edmodo.com)
Breach date: 2017-05-11
Accounts affected: 43423561
Data exposed: Email addresses, Passwords, Usernames
In May 2017, the education platform Edmodo was hacked resulting in the exposure of 77 million records comprised of over 43 million unique customer email addresses. The data was consequently published to a popular hacking forum and made freely available. The records in the breach included usernames, email addresses and bcrypt hashes of passwords.
Elance (elance.com)
Breach date: 2009-01-01
Accounts affected: 1291178
Data exposed: Email addresses, Employers, Geographic locations, Passwords, Phone numbers, Usernames
Sometime in 2009, staffing platform Elance suffered a data breach that impacted 1.3 million accounts. Appearing online 8 years later, the data contained usernames, email addresses, phone numbers and SHA1 hashes of passwords, amongst other personal data.
Elanic (elanic.in)
Breach date: 2018-01-01
Accounts affected: 2325283
Data exposed: Email addresses, Geographic locations, Usernames
In January 2020, the Indian fashion marketplace Elanic had 2.8M records with 2.3M unique email addresses posted publicly to a popular hacking forum. Elanic confirmed that they had "verified the data and it was pulled from one of our test servers where this data was exposed publicly" and that the data was "old" (the hacking forum reported it as being from 2016-2018). When asked about disclosure to impacted customers, Elanic advised that they had "decided to not have as such any communication and public disclosure".
Elasticsearch Instance of Sales Leads on AWS ()
Breach date: 2018-10-29
Accounts affected: 5788169
Data exposed: Email addresses, Employers, Names, Physical addresses
In October 2018, security researcher Bob Diachenko identified multiple exposed databases with hundreds of millions of records. One of those datasets was an Elasticsearch instance on AWS containing sales lead data and 5.8M unique email addresses. The data contained information relating to individuals and the companies they worked for including their names, email addresses and company name and contact information. Despite best efforts, it was not possible to identify the owner of the data hence this breach as been titled "Elasticsearch Sales Leads".
Emotet ()
Breach date: 2021-01-27
Accounts affected: 4324770
Data exposed: Email addresses, Passwords
In January 2021, the FBI in partnership with the Dutch NHTCU, German BKA and other international law enforcement agencies brought down the world's most dangerous malware: Emotet. The agencies obtained data collected by the malware and provided impacted email addresses to HIBP so that impacted individuals and domain owners could assess their exposure. Read more about the takedown and recommended actions.
Emuparadise (emuparadise.me)
Breach date: 2018-04-01
Accounts affected: 1131229
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In April 2018, the self-proclaimed "biggest retro gaming website on earth", Emuparadise, suffered a data breach. The compromised vBulletin forum exposed 1.1 million email addresses, IP address, usernames and passwords stored as salted MD5 hashes. The data was provided to HIBP by dehashed.com.
England Cricket (ecb.co.uk)
Breach date: 2024-03-23
Accounts affected: 43299
Data exposed: Email addresses, Passwords
In March 2024, English Cricket's icoachcricket website suffered a data breach that exposed over 40k records. The data included email addresses and passwords stored as either bcrypt hashes, salted MD5 hashes or both.
E-Pal (epal.gg)
Breach date: 2022-04-15
Accounts affected: 108887
Data exposed: Email addresses, Purchases, Usernames
In October 2022, the service dedicated to finding friends on Discord known as E-Pal disclosed a data breach. The compromised data included over 100k unique email addresses and usernames spanning approximately 1M orders. The data was subsequently distributed via a popular hacking forum.
Epic Games (epicgames.com)
Breach date: 2016-08-11
Accounts affected: 251661
Data exposed: Email addresses, Passwords, Usernames
In August 2016, the Epic Games forum suffered a data breach, allegedly due to a SQL injection vulnerability in vBulletin. The attack resulted in the exposure of 252k accounts including usernames, email addresses and salted MD5 hashes of passwords.
EpicBot (epicbot.com)
Breach date: 2019-09-01
Accounts affected: 816662
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In September 2019, the RuneScape bot provider EpicBot suffered a data breach that impacted 817k subscribers. Data from the breach was subsequently shared on a popular hacking forum and included usernames, email and IP addresses and passwords stored as either salted MD5 or bcrypt hashes. EpicBot did not respond when contacted about the incident.
EpicNPC (epicnpc.com)
Breach date: 2016-01-02
Accounts affected: 408795
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In January 2016, the hacked account reseller EpicNPC suffered a data breach that impacted 409k subscribers. The impacted data included usernames, IP and email addresses and passwords stored as salted MD5 hashes. The data was provided to HIBP by dehashed.com.
Epik (epik.com)
Breach date: 2021-09-13
Accounts affected: 15003961
Data exposed: Email addresses, Names, Phone numbers, Physical addresses, Purchases
In September 2021, the domain registrar and web host Epik suffered a significant data breach, allegedly in retaliation for hosting alt-right websites. The breach exposed a huge volume of data not just of Epik customers, but also scraped WHOIS records belonging to individuals and organisations who were not Epik customers. The data included over 15 million unique email addresses (including anonymised versions for domain privacy), names, phone numbers, physical addresses, purchases and passwords stored in various formats.
Eroticy (eroticy.com)
Breach date: 2015-06-01
Accounts affected: 1370175
Data exposed: Email addresses, IP addresses, Names, Passwords, Payment histories, Phone numbers, Physical addresses, Usernames, Website activity
In mid-2016, it's alleged that the adult website known as Eroticy was hacked. Almost 1.4 million unique accounts were found circulating in late 2016 which contained a raft of personal information ranging from email addresses to phone numbers to plain text passwords. Whilst many HIBP subscribers confirmed their data was legitimate, the actual source of the breach remains inconclusive. A detailed account of the data has been published in the hope of identifying the origin of the breach.
Eskimi (eskimi.com)
Breach date: 2020-09-25
Accounts affected: 1197620
Data exposed: Dates of birth, Email addresses, Genders, Geographic locations, Passwords, Usernames
In late 2020, the AdTech platform Eskimi suffered a data breach that exposed 26M records with 1.2M unique email addresses. The data included usernames, dates of birth, genders and passwords stored as unsalted MD5 hashes.
Estante Virtual (estantevirtual.com.br)
Breach date: 2019-02-28
Accounts affected: 5412603
Data exposed: Dates of birth, Email addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
In February 2019, the Brazilian book store Estante Virtual suffered a data breach that impacted 5.4M customers. The exposed data included names, usernames, email and physical addresses, phone numbers, dates of birth and unsalted SHA-1 password hashes.
Estonian Citizens (via Estonian Cybercrime Bureau) ()
Breach date: 2018-06-07
Accounts affected: 655161
Data exposed: Email addresses, Passwords
In June 2018, the Cybercrime Bureau of the Estonian Central Criminal Police contacted HIBP and asked for assistance in making a data set of 655k email addresses searchable. The Estonian police suspected the email addresses and passwords they obtained were being used to access mailboxes, cryptocurrency exchanges, cloud service accounts and other similar online assets. They've requested that individuals who find themselves in the data set and also identify that cryptocurrency has been stolen contact them at cybercrime@politsei.ee.
eThekwini Municipality (eservices.durban.gov.za)
Breach date: 2016-09-07
Accounts affected: 81830
Data exposed: Dates of birth, Deceased date, Email addresses, Genders, Government issued IDs, Names, Passport numbers, Passwords, Phone numbers, Physical addresses, Utility bills
In September 2016, the new eThekwini eServices website in South Africa was launched with a number of security holes that lead to the leak of over 98k residents' personal information and utility bills across 82k unique email addresses. Emails were sent prior to launch containing passwords in plain text and the site allowed anyone to download utility bills without sufficient authentication. Various methods of customer data enumeration was possible and phishing attacks began appearing the day after launch.
Ethereum (ethereum.org)
Breach date: 2016-12-16
Accounts affected: 16431
Data exposed: Email addresses, IP addresses, Passwords, Private messages, Usernames, Website activity
In December 2016, the forum for the public blockchain-based distributed computing platform Ethereum suffered a data breach. The database contained over 16k unique email addresses along with IP addresses, private forum messages and (mostly) bcrypt hashed passwords. Ethereum elected to self-submit the data to HIBP, providing the service with a list of email addresses impacted by the incident.