Tiago2024180/eyewebdataset huggingface dataset:
Insanelyi (insanelyi.com)
Breach date: 2014-07-22
Accounts affected: 104097
Data exposed: Email addresses, Passwords, Usernames, Website activity
In July 2014, the iOS forum Insanelyi was hacked by an attacker known as Kim Jong-Cracks. A popular source of information for users of jailbroken iOS devices running Cydia, the Insanelyi breach disclosed over 104k users' emails addresses, user names and weakly hashed passwords (salted MD5).
Instagram (instagram.com)
Breach date: 2026-01-07
Accounts affected: 6215150
Data exposed: Display names, Email addresses, Geographic locations, Phone numbers, Usernames
In January 2026, data allegedly scraped via an Instagram API was posted to a popular hacking forum. The dataset contained 17M rows of public Instagram information, including usernames, display names, account IDs, and in some cases, geolocation data. Of these records, 6.2M included an associated email address, and some also contained a phone number. The scraped data appears to be unrelated to password reset requests initiated on the platform, despite coinciding in timeframe. There is no evidence that passwords or other sensitive data were compromised.
Instant Checkmate (instantcheckmate.com)
Breach date: 2019-04-12
Accounts affected: 11943887
Data exposed: Email addresses, Names, Passwords, Phone numbers
In 2019, the public records search service Instant Checkmate suffered a data breach that later came to light in early 2023. The data included almost 12M unique customer email addresses, names, phone numbers and passwords stored as scrypt hashes.
Instituto Nacional de Deportes de Chile (ind.cl)
Breach date: 2024-09-12
Accounts affected: 319613
Data exposed: Dates of birth, Email addresses, Genders, Names, Passwords, Usernames
In September 2024, the Instituto Nacional de Deportes de Chile (Chile's National Sports Institute) suffered a data breach. The incident exposed 1.7M rows of data with 320k unique email addresses alongside names, dates of birth, genders and bcrypt password hashes. The newest records in the data date back to August 2022, suggesting the breach may be of an older data set.
Intelimost (intelimost.com)
Breach date: 2019-03-10
Accounts affected: 3073409
Data exposed: Email addresses, Passwords
In March 2019, a spam operation known as "Intelimost" sent millions of emails appearing to come from people the recipients knew. Security researcher Bob Diachenko found over 3 million unique email addresses in an exposed Elasticsearch database, alongside plain text passwords used to access the victim's mailbox and customise the spam.
International Kiteboarding Organization (ikointl.com)
Breach date: 2025-11-11
Accounts affected: 340349
Data exposed: Email addresses, Geographic locations, Names, Usernames
In November 2025, the International Kiteboarding Organization suffered a data breach that exposed 340k user records. The data was subsequently listed for sale on a hacking forum and included email addresses, names, usernames and in many cases, the user's city and country.
Internet Archive (archive.org)
Breach date: 2024-09-28
Accounts affected: 31081179
Data exposed: Email addresses, Passwords, Usernames
In September 2024, the digital library of internet sites Internet Archive suffered a data breach that exposed 31M records. The breach exposed user records including email addresses, screen names and bcrypt password hashes.
InterPals (interpals.net)
Breach date: 2015-11-04
Accounts affected: 3439414
Data exposed: Dates of birth, Email addresses, Geographic locations, Names, Passwords, Usernames
In late 2015, the online penpal site InterPals had their website hacked and 3.4 million accounts exposed. The compromised data included email addresses, geographical locations, birthdates and salted hashes of passwords.
iPmart (ipmart-forum.com)
Breach date: 2015-07-01
Accounts affected: 2460787
Data exposed: Dates of birth, Email addresses, Passwords, Usernames
During 2015, the iPmart forum (now known as Mobi NUKE) was hacked and over 2 million forum members' details were exposed. The vBulletin forum included IP addresses, birth dates and passwords stored as salted hashes using a weak implementation enabling many to be rapidly cracked. A further 368k accounts were added to "Have I Been Pwned" in March 2016 bringing the total to over 2.4M.
ixigo (ixigo.com)
Breach date: 2019-01-03
Accounts affected: 17204697
Data exposed: Auth tokens, Device information, Email addresses, Genders, Names, Passwords, Phone numbers, Salutations, Social media profiles, Usernames
In January 2019, the travel and hotel booking site ixigo suffered a data breach. The data appeared for sale on a dark web marketplace the following month and included over 17M unique email addresses alongside names, genders, phone numbers, connections to Facebook profiles and passwords stored as MD5 hashes.
Jam Tangan (jamtangan.com)
Breach date: 2021-07-06
Accounts affected: 434784
Data exposed: Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses
In July 2021, the online Indonesian watch store, Jam Tangan (AKA Machtwatch), suffered a data breach that exposed over 400k customer records which were subsequently posted to a popular hacking forum. The data included email and IP addresses, names, phone numbers, physical addresses and passwords stored as either unsalted MD5 or bcrypt hashes.
James (jamesdelivery.com.br)
Breach date: 2020-03-25
Accounts affected: 1541284
Data exposed: Email addresses, Geographic locations, Passwords
In June 2020, 14 previously undisclosed data breaches appeared for sale including the Brazilian delivery service, "James". The breach occurred in March 2020 and exposed 1.5M unique email addresses, customer locations expressed in longitude and latitude and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
JD (jd.com)
Breach date: 2013-01-01
Accounts affected: 77449341
Data exposed: Email addresses, Passwords, Phone numbers, Usernames
In 2013 (exact date unknown), the Chinese e-commerce service JD suffered a data breach that exposed 13GB of data containing 77 million unique email addresses. The data also included usernames, phone numbers and passwords stored as SHA-1 hashes.
JD Group (jdgroup.co.za)
Breach date: 2023-05-31
Accounts affected: 521878
Data exposed: Email addresses, Government issued IDs, Names, Phone numbers, Physical addresses
In May 2023, the South African retailer JD Group announced a data breach affecting a number of their online assets including Bradlows, Everyshop, HiFi Corp, Incredible (Connection), Rochester, Russells, and Sleepmasters. The breach exposed over 520k unique customer records including names, email and physical addresses, phone numbers and South African ID numbers.
Jefit (jefit.com)
Breach date: 2020-08-11
Accounts affected: 9052457
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In August 2020, the workout tracking app Jefit suffered a data breach. The data was subsequently sold within the hacking community and included over 9 million email and IP addresses, usernames and passwords stored as either vBulletin or argon2 hashes. Several million cracked passwords later appeared in broad circulation.
Jobandtalent (jobandtalent.com)
Breach date: 2018-02-01
Accounts affected: 10981207
Data exposed: Email addresses, IP addresses, Names, Passwords
In approximately February 2018, the employment website Jobandtalent suffered a data breach which then appeared for sale alongside other breaches a year later. The incident impacted 11 million subscribers and exposed their names, email and IP addresses and passwords stored as salted SHA-1 hashes.
JobStreet (jobstreet.com)
Breach date: 2012-03-07
Accounts affected: 3883455
Data exposed: Dates of birth, Email addresses, Genders, Geographic locations, Government issued IDs, Marital statuses, Names, Nationalities, Passwords, Phone numbers, Physical addresses, Usernames
In October 2017, the Malaysian website lowyat.net ran a story on a massive set of breached data affecting millions of Malaysians after someone posted it for sale on their forums. The data spanned multiple separate breaches including the JobStreet jobs website which contained almost 4 million unique email addresses. The dates in the breach indicate the incident occurred in March 2012. The data later appeared freely downloadable on a Tor hidden service and contained extensive information on job seekers including names, genders, birth dates, phone numbers, physical addresses and passwords.
Jobzone (jobzone.co.il)
Breach date: 2023-04-15
Accounts affected: 29708
Data exposed: Dates of birth, Email addresses, Family members' names, Genders, Government issued IDs, Names, Phone numbers, Physical addresses
In April 2023, data from the Israeli jobs website Jobzone was posted online. The data included 30k records of email addresses, names, social security numbers, genders, dates of birth, fathers' names and physical addresses.
JoomlArt (joomlart.com)
Breach date: 2018-01-30
Accounts affected: 22477
Data exposed: Email addresses, Names, Passwords, Payment histories, Usernames
In January 2018, the Joomla template website JoomlArt inadvertently exposed more than 22k unique customer records in a Jira ticket. The exposed data was from iJoomla and JomSocial, both services that JoomlArt acquired the previous year. The data included usernames, email addresses, purchases and passwords stored as MD5 hashes. When contacted, JoomlArt advised they were aware of the incident and had previously notified impacted parties.
JoyGames (joygames.me)
Breach date: 2019-12-14
Accounts affected: 4461787
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In December 2019, the forum for the JoyGames website suffered a data breach that exposed 4.5M unique email addresses. The impacted data also included usernames, IP addresses and salted MD5 password hashes.
JukinMedia (jukinmedia.com)
Breach date: 2021-10-28
Accounts affected: 314290
Data exposed: Email addresses, Employers, IP addresses, Names, Occupations, Passwords, Phone numbers
In October 2021, the "global leader in user-generated entertainment" Jukin Media suffered a data breach. The breach exposed 13GB of code, configuration and data consisting of 314k unique email addresses along with names, phone numbers, IP addresses and bcrypt password hashes.
Justdate.com (justdate.com)
Breach date: 2016-09-29
Accounts affected: 24451312
Data exposed: Dates of birth, Email addresses, Geographic locations, Names
An alleged breach of the dating website Justdate.com began circulating in approximately September 2016. Comprised of over 24 million records, the data contained various personal attributes such as email addresses, dates of birth and physical locations. However, upon verification with HIBP subscribers, only a fraction of the data was found to be accurate and no account owners recalled using the Justdate.com service. This breach has consequently been flagged as fabricated; it's highly unlikely the data was sourced from Justdate.com.
Kaneva (kaneva.com)
Breach date: 2016-07-01
Accounts affected: 3901179
Data exposed: Dates of birth, Email addresses, Passwords, Usernames
In July 2016, now defunct website Kaneva, the service to "build and explore virtual worlds", suffered a data breach that exposed 3.9M user records. The data included email addresses, usernames, dates of birth and salted MD5 password hashes.
Kaspersky Club (kasperskyclub.ru)
Breach date: 2024-03-24
Accounts affected: 55971
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In March 2024, the independent fan forum Kaspersky Club suffered a data breach. The incident exposed 56k unique email addresses alongside usernames, IP addresses and passwords stored as either MD5 or bcrypt hashes.
Kayo.moe Credential Stuffing List ()
Breach date: 2018-09-11
Accounts affected: 41826763
Data exposed: Email addresses, Passwords
In September 2018, a collection of almost 42 million email address and plain text password pairs was uploaded to the anonymous file sharing service kayo.moe. The operator of the service contacted HIBP to report the data which, upon further investigation, turned out to be a large credential stuffing list. For more information, read about The 42M Record kayo.moe Credential Stuffing Data.
Kickstarter (kickstarter.com)
Breach date: 2014-02-16
Accounts affected: 5176463
Data exposed: Email addresses, Passwords
In February 2014, the crowdfunding platform Kickstarter announced they'd suffered a data breach. The breach contained almost 5.2 million unique email addresses, usernames and salted SHA1 hashes of passwords.
Kimsufi (kimsufi.com)
Breach date: 2015-05-01
Accounts affected: 504565
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In mid-2015, the forum for the providers of affordable dedicated servers known as Kimsufi suffered a data breach. The vBulletin forum contained over half a million accounts including usernames, email and IP addresses and passwords stored as salted MD5 hashes.
KinoKong (kinokong.org)
Breach date: 2021-03-25
Accounts affected: 817808
Data exposed: Email addresses, IP addresses, Names, Passwords, Usernames
In March 2021, the Russian online streaming service KinoKong suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed over 800k unique email addresses along with names, usernames, IP addresses and MD5 password hashes.
KitchenPal (kitchenpalapp.com)
Breach date: 2023-11-14
Accounts affected: 98726
Data exposed: Dates of birth, Email addresses, Genders, Geographic locations, Names, Passwords, Physical attributes, Social media profiles
In November 2023, the kitchen management application KitchenPal suffered a data breach that exposed 146k lines of data. When contacted about the incident, KitchenPal advised the corpus of data came from a staging environment, although acknowledged it contained a small number of users for debugging purposes and included passwords that could not be used. Impacted data included almost 100k email addresses, names, geolocations and incomplete data on dates of birth, genders, height and weight, social media profile identifiers and bcrypt password hashes.
KiwiFarms (kiwifarms.net)
Breach date: 2019-09-10
Accounts affected: 4606
Data exposed: Avatars, Dates of birth, Email addresses, IP addresses, Website activity
In September 2019, the forum for discussing "lolcows" (people who can be milked for laughs) Kiwi Farms suffered a data breach. The disclosure notice advised that email and IP addresses, dates of birth and content created by members were all exposed in the incident.
KM.RU (km.ru)
Breach date: 2016-02-29
Accounts affected: 1476783
Data exposed: Dates of birth, Email addresses, Genders, Geographic locations, Recovery email addresses, Security questions and answers, Usernames
In February 2016, the Russian portal and email service KM.RU was the target of an attack which was consequently detailed on Reddit. Allegedly protesting "the foreign policy of Russia in regards to Ukraine", KM.RU was one of several Russian sites in the breach and impacted almost 1.5M accounts including sensitive personal information.
KnownCircle (knowncircle.com)
Breach date: 2016-04-12
Accounts affected: 1957600
Data exposed: Email addresses, Email messages, Genders, Names, Passwords, Phone numbers, Physical addresses
In approximately April 2016, the "marketing automation for agents and professional service providers" company KnownCircle had a large volume of data obtained by an external party. The data belonging to the now defunct service appeared in JSON format and contained gigabytes of data related to the real estate and insurance sectors. The personal data in the breach appears to have primarily been used for marketing purposes, including logs of emails sent and tracking of gift cards. A small number of passwords for KnownCircle staff were also present and were stored as bcrypt hashes.
Knuddels (knuddels.de)
Breach date: 2018-09-05
Accounts affected: 808330
Data exposed: Email addresses, Geographic locations, Names, Passwords, Usernames
In September 2018, the German social media website Knuddels suffered a data breach. The incident exposed 808k unique email addresses alongside usernames, real names, the city of the person and their password in plain text. Knuddels was subsequently fined €20k for the breach.
KomikoAI (komiko.app)
Breach date: 2026-02-25
Accounts affected: 1060191
Data exposed: AI prompts, Email addresses, Forum posts, Names
In February, the AI-powered comic generation platform KomikoAI suffered a data breach. The incident exposed 1M unique email addresses along with names, user posts and the AI prompts used to generate content. The exposed data enables the mapping of individual AI prompts to specific email addresses.
KomplettFritid (komplettfritid.no)
Breach date: 2021-02-01
Accounts affected: 139401
Data exposed: Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses
In January 2023, the online Norwegian store KomplettFritid was reported as having had a data breach dating back to February 2021. The incident exposed 140k customer records including physical, email and IP addresses, names, phone numbers and passwords. Most passwords were stored as bcrypt hashes with a small number appearing in plain text.
Kreditplus (kreditplus.com)
Breach date: 2020-06-23
Accounts affected: 768890
Data exposed: Dates of birth, Email addresses, Employers, Family structure, Genders, Income levels, Living costs, Marital statuses, Mothers maiden names, Names, Phone numbers, Physical addresses, Places of birth, Religions, Spouses names
In June 2020, the Indonesian credit service Kreditplus suffered a data breach which exposed 896k records containing 769k unique email addresses. The breach exposed extensive personal information including names, family makeup, information on spouses, income and expenses, religions and employment information. The data was provided to HIBP by breachbase.pw.
La Poste Mobile (lapostemobile.fr)
Breach date: 2022-07-04
Accounts affected: 533886
Data exposed: Bank account numbers, Dates of birth, Email addresses, Genders, Names, Phone numbers, Physical addresses
In July 2022, the French telecommunications company La Poste Mobile was the target of an attack by the LockBit ransomware which resulted in company data being published publicly. The impacted data included 533k unique email addresses along with names, physical addresses, phone numbers, dates of births, genders and banking information. 10 days after the attack, the La Poste Mobile website remained offline.
Ladies.com (ladies.com)
Breach date: 2024-07-03
Accounts affected: 118809
Data exposed: Bios, Dates of birth, Drinking habits, Education levels, Email addresses, Family structure, Genders, Geographic locations, Photos, Profile photos, Relationship statuses, Sexual orientations, Smoking habits, Tattoo status, Usernames
In 2024, the lesbian dating website ladies.com suffered a data breach. Attributed to an exposed Firebase database, the breach included extensive personal information on 119k users of the service including email addresses, photos, sexual orientation, genders, dates of birth and precise latitude and longitude, among other personal attributes. The website was shut down in mid-2024 and the breach later acknowledged by the site operator in December, along with a breach of the "Senior Dating" website run by the same organisation.
LandAirSea (landairsea.com)
Breach date: 2025-01-12
Accounts affected: 337373
Data exposed: Email addresses, Names, Partial credit card data, Passwords, Physical addresses, Usernames
In January 2025, the GPS tracking service LandAirSea suffered a data breach that exposed 337k unique customer email addresses alongside names, usernames and password hashes. The breach also exposed partial credit card data (card type, last 4 digits and expiration), and GPS device identifiers and locations. LandAirSea is aware of the breach and has remediated the underlying vulnerability.
Lanwar (lanwar.com)
Breach date: 2018-07-28
Accounts affected: 45120
Data exposed: Email addresses, Names, Passwords, Physical addresses, Usernames
In July 2018, staff of the Lanwar gaming site discovered a data breach they believe dates back to sometime over the previous several months. The data contained 45k names, email addresses, usernames and plain text passwords. A Lanwar staff member self-submitted the breach to HIBP and has also contacted the relevant authorities about the incident after identifying a phishing attempt to extort Bitcoin from a user.
Last.fm (last.fm)
Breach date: 2012-03-22
Accounts affected: 37217682
Data exposed: Email addresses, Passwords, Usernames, Website activity
In March 2012, the music website Last.fm was hacked and 43 million user accounts were exposed. Whilst Last.fm knew of an incident back in 2012, the scale of the hack was not known until the data was released publicly in September 2016. The breach included 37 million unique email addresses, usernames and passwords stored as unsalted MD5 hashes.
Latest Pilot Jobs (latestpilotjobs.com)
Breach date: 2022-08-14
Accounts affected: 118864
Data exposed: Email addresses, Names, Passwords, Usernames
In August 2022, the Latest Pilot Jobs website suffered a data breach that later appeared on a popular hacking forum before being redistributed as part of a larger corpus of data. The data included 119k unique email addresses along with names, usernames and unsalted MD5 password hashes.
Lazada RedMart (redmart.lazada.sg)
Breach date: 2020-07-30
Accounts affected: 1107789
Data exposed: Email addresses, Names, Partial credit card data, Passwords, Phone numbers, Physical addresses
In October 2020, news broke of Lazada RedMart data breach containing records as recent as July 2020 and being sold via an online marketplace. In all, the data contained 1.1 million customer email addresses alongside names, phone numbers, physical addresses, partial credit card numbers and passwords stored as SHA-1 hashes.
LBB (lbb.in)
Breach date: 2019-02-14
Accounts affected: 39288
Data exposed: Browser user agent details, Email addresses, IP addresses, Names, Physical addresses
In August 2022, customer data of the Indian shopping site "LBB" (Little Black Book) was posted to a popular hacking forum. The data contained over 3M records with 39k unique email addresses alongside IP and physical addresses, names and device information with the most recent data dating back to early 2019. LBB advised they believe the data was exposed by a third party service and whilst it contained information they retain on their customers, it had also been enriched with additional data attributes.
LDLC (ldlc.com)
Breach date: 2024-02-28
Accounts affected: 1266026
Data exposed: Email addresses, Names, Phone numbers, Physical addresses, Salutations
In March 2024, French retailer LDLC disclosed a data breach that impacted customers of their physical stores. The data was previously listed for sale on a popular hacking forum and contained 1.26M unique email addresses along with names, phone numbers and physical addresses.
Le Coq Sportif Columbia (lecoqsportif.com.co)
Breach date: 2023-05-01
Accounts affected: 79712
Data exposed: Dates of birth, Device information, Email addresses, Genders, IP addresses, Names, Passwords, Physical addresses, Purchases
In January 2025, a data breach from the Columbian website for Le Coq Sportif was posted to a popular hacking forum. The data included almost 80k unique email addresses with the breach dating back to May 2023. Impacted data included physical and IP addresses, names, purchases, genders, dates of birth and bcrypt password hashes.
Le Slip Français (leslipfrancais.fr)
Breach date: 2024-04-13
Accounts affected: 1495127
Data exposed: Email addresses, Names, Phone numbers, Physical addresses
In April 2024, the French underwear maker Le Slip Français suffered a data breach. The breach included 1.5M email addresses, physical addresses, names and phone numbers.