Tiago2024180/eyewebdataset huggingface dataset:
XPG (xpgamesaves.com)
Breach date: 2016-01-01
Accounts affected: 890341
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In approximately early 2016, the gaming website Xpgamesaves (XPG) suffered a data breach resulting in the exposure of 890k unique user records. The data contained email and IP addresses, usernames and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory. This data was provided by security researcher and data analyst, Adam Davies.
XSplit (xsplit.com)
Breach date: 2013-11-07
Accounts affected: 2983472
Data exposed: Email addresses, Names, Passwords, Usernames
In November 2013, the makers of gaming live streaming and recording software XSplit was compromised in an online attack. The data breach leaked almost 3M names, email addresses, usernames and hashed passwords.
Yahoo (yahoo.com)
Breach date: 2012-07-11
Accounts affected: 453427
Data exposed: Email addresses, Passwords
In July 2012, Yahoo! had their online publishing service "Voices" compromised via a SQL injection attack. The breach resulted in the disclosure of nearly half a million usernames and passwords stored in plain text. The breach showed that of the compromised accounts, a staggering 59% of people who also had accounts in the Sony breach reused their passwords across both services.
Yam (yam.com)
Breach date: 2013-06-02
Accounts affected: 13258797
Data exposed: Dates of birth, Email addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
In June 2013, the Taiwanese website Yam.com suffered a data breach which was shared to a popular hacking forum in 2021. The data included 13 million unique email addresses alongside names, usernames, phone numbers, physical addresses, dates of birth and unsalted MD5 password hashes.
Yandex Dump (forum.btcsec.com)
Breach date: 2014-09-07
Accounts affected: 1186564
Data exposed: Email addresses, Passwords
In September 2014, news broke of a massive leak of accounts from Yandex, the Russian search engine giants who also provides email services. The purported million "breached" accounts were disclosed at the same time as nearly 5M mail.ru accounts with both companies claiming the credentials were acquired via phishing scams rather than being obtained as a result of direct attacks against their services.
Yatra (yatra.com)
Breach date: 2013-09-01
Accounts affected: 5033997
Data exposed: Dates of birth, Email addresses, Names, Passwords, Phone numbers, Physical addresses, PINs
In September 2013, the Indian bookings website known as Yatra had 5 million records exposed in a data breach. The data contained email and physical addresses, dates of birth and phone numbers along with both PINs and passwords stored in plain text. The site was previously reported as compromised on the Vigilante.pw breached database directory.
Yonéma (yonema.com)
Breach date: 2024-11-21
Accounts affected: 35962
Data exposed: Dates of birth, Device information, Email addresses, IP addresses, Names, Passwords, Phone numbers
In November 2024, data from the Senegalese payment platform Yonéma was posted to a popular hacking forum. The data included 36k unique email addresses alongside phone numbers, names and what appears to be encrypted passwords and dates of birth.
yotepresto.com (yotepresto.com)
Breach date: 2020-06-22
Accounts affected: 1444629
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In June 2020, the Mexican lending platform yotepresto.com suffered a data breach. Over 1.4 million customers were impacted by the breach which disclosed email and IP addresses, usernames and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
Youku (youku.com)
Breach date: 2016-12-01
Accounts affected: 91890110
Data exposed: Email addresses, Passwords
In late 2016, the online Chinese video service Youku suffered a data breach. The incident exposed 92 million unique user accounts and corresponding MD5 password hashes. The data was contributed to Have I Been Pwned courtesy of rip@creep.im.
Young Living Essential Oils (youngliving.com)
Breach date: 2024-12-11
Accounts affected: 1128951
Data exposed: Dates of birth, Email addresses, Geographic locations, Names
In December 2024, data claimed to be breached from the multi-level marketing company Young Living Essential Oils was posted to a popular hacking forum. The data contained 1.1M unique email addresses alongside names, the country of the account and in many cases, their date of birth. Young Living Essential Oils did not respond to multiple attempts to contact them about the data.
YouNow (younow.com)
Breach date: 2019-02-15
Accounts affected: 18241518
Data exposed: Email addresses, IP addresses, Names, Social media profiles, Usernames
In February 2019, data from the live broadcasting service YouNow appeared for sale on a dark web marketplace. Whilst it's not clear what date the actual breach occurred on, the impacted data included 18M unique email addresses, IP addresses, names, usernames and links to social media profiles. As authentication is performed via social providers, no passwords were exposed in the breach. Many records didn't have associated email addresses thus the unique number is lower than the reported total number of accounts.
YouPorn (youporn.com)
Breach date: 2012-02-21
Accounts affected: 1327567
Data exposed: Email addresses, Passwords
In February 2012, the adult website YouPorn had over 1.3M user accounts exposed in a data breach. The publicly released data included both email addresses and plain text passwords.
Youthmanual (youthmanual.com)
Breach date: 2019-01-31
Accounts affected: 937912
Data exposed: Bios, Dates of birth, Email addresses, Genders, Names, Passwords, Phone numbers, Physical addresses, Places of birth
In January 2019, the Indonesian college and career platform Youthmanual suffered a data breach that exposed 1.1M records of data. The breached included 938k unique email addresses along with extensive personal information including names, genders, dates and places of birth, phone numbers, physical addresses and salted SHA-1 password hashes.
You've Been Scraped ()
Breach date: 2018-10-05
Accounts affected: 66147869
Data exposed: Email addresses, Employers, Geographic locations, Job titles, Names, Social media profiles
In October and November 2018, security researcher Bob Diachenko identified several unprotected MongoDB instances believed to be hosted by a data aggregator. Containing a total of over 66M records, the owner of the data couldn't be identified but it is believed to have been scraped from LinkedIn hence the title "You've Been Scraped". The exposed records included names, both work and personal email addresses, job titles and links to the individuals' LinkedIn profiles.
Zacks (zacks.com)
Breach date: 2020-05-10
Accounts affected: 8929503
Data exposed: Email addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
In December 2022, the investment research company Zacks announced a data breach. The following month, reports emerged of the incident impacting 820k customers. However, in June 2023, a corpus of data with almost 9M Zacks customers appeared before being broadly circulated on a popular hacking forum. The most recent data was dated May 2020 and included names, usernames, email and physical addresses, phone numbers and passwords stored as unsalted SHA-256 hashes. On disclosure of the larger breach, Zacks advised that in addition to their original report "the unauthorised third parties also gained access to encrypted [sic] passwords of zacks.com customers, but only in the encrypted [sic] format".
Zacks (2024) (zacks.com)
Breach date: 2024-06-22
Accounts affected: 11994223
Data exposed: Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
In June 2024, the investment research company Zacks was allegedly breached, and data was later published to a popular hacking forum. This comes after a separate Zacks data breach confirmed by the organisation in 2023 with the subsequent breach disclosing millions of additional records representing a superset of data from the first incident. The 2024 breach included 12M unique email addresses along with IP and physical addresses, names, usernames, phone numbers and unsalted SHA-256 password hashes. Zacks did not respond to multiple attempts to contact them about the incident.
Zadig & Voltaire (zadig-et-voltaire.com)
Breach date: 2023-11-16
Accounts affected: 586895
Data exposed: Email addresses, Genders, Names, Phone numbers, Physical addresses
In June 2024, a data brach sourced from French fashion brand Zadig & Voltaire was publicly posted to a popular hacking forum. The data included names, email and physical addresses, phone numbers and genders. When contacted about the incident, Zadig & Voltaire advised the incident had occurred more than 6 months ago and that "all measures were taken quickly".
ZAP-Hosting (zap-hosting.com)
Breach date: 2021-11-22
Accounts affected: 746682
Data exposed: Browser user agent details, Chat logs, Email addresses, IP addresses, Names, Phone numbers, Physical addresses, Purchases
In November 2021, web host ZAP-Hosting suffered a data breach that exposed over 60GB of data containing 746k unique email addresses. The breach also contained support chat logs, IP addresses, names, purchases, physical addresses and phone numbers.
Zhenai.com (zhenai.com)
Breach date: 2011-12-21
Accounts affected: 5024908
Data exposed: Email addresses, Passwords
In December 2011, the Chinese dating site known as Zhenai.com suffered a data breach that impacted 5 million subscribers. Whilst there is evidence that the data is legitimate, due to the difficulty of emphatically verifying the Chinese breach it has been flagged as "unverified". The data in the breach contains email addresses and plain text passwords. Read more about Chinese data breaches in Have I Been Pwned.
Zilvia.net (zilvia.net)
Breach date: 2025-11-06
Accounts affected: 287863
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In November 2025, data breached from the Zilvia.net Nissan 240SX Silvia and Z Fairlady car forum was leaked. The breach exposed 288k unique email addresses along with usernames, IP addresses and salted MD5 password hashes sourced from the vBulletin based platform. Attempts to contact Zilvia.net about the incident were unsuccessful.
Z-lib (z-lib.is)
Breach date: 2024-06-20
Accounts affected: 9737374
Data exposed: Cryptocurrency wallet addresses, Email addresses, Geographic locations, Passwords, Purchases, Usernames
In June 2024, almost 10M user records from Z-lib were discovered exposed online. Now defunct, Z-lib was a malicious clone of Z-Library, a well-known shadow online platform for pirating books and academic papers. The exposed data included usernames, email addresses, countries of residence, Bitcoin and Monero cryptocurrency wallet addresses, purchases and bcrypt password hashes.
Zomato (zomato.com)
Breach date: 2017-05-17
Accounts affected: 16472873
Data exposed: Email addresses, Passwords, Usernames
In May 2017, the restaurant guide website Zomato was hacked resulting in the exposure of almost 17 million accounts. The data was consequently redistributed online and contains email addresses, usernames and salted MD5 hashes of passwords (the password hash was not present on all accounts). This data was provided to HIBP by whitehat security researcher and data analyst Adam Davies.
Zoomcar (zoomcar.com)
Breach date: 2018-07-01
Accounts affected: 3589795
Data exposed: Email addresses, IP addresses, Names, Passwords, Phone numbers
In July 2018, the Indian self-drive car rental company Zoomcar suffered a data breach which was subsequently sold on a dark web marketplace in 2020. The breach exposed over 3.5M records including names, email and IP addresses, phone numbers and passwords stored as bcrypt hashes. The data was provided to HIBP by dehashed.com.
Zoosk (2011) (zoosk.com)
Breach date: 2011-01-01
Accounts affected: 52578183
Data exposed: Email addresses, Passwords
In approximately 2011, an alleged breach of the dating website Zoosk began circulating. Comprised of almost 53 million records, the data contained email addresses and plain text passwords. However, during extensive verification in May 2016 no evidence could be found that the data was indeed sourced from the dating service. This breach has consequently been flagged as fabricated; it's highly unlikely the data was sourced from Zoosk.
Zoosk (2020) (zoosk.com)
Breach date: 2020-01-12
Accounts affected: 23927853
Data exposed: Dates of birth, Drinking habits, Education levels, Email addresses, Ethnicities, Family structure, Genders, Geographic locations, Income levels, Names, Nicknames, Physical attributes, Political views, Relationship statuses, Religions, Sexual orientations, Smoking habits
In January 2020, the online dating service Zoosk suffered a data breach which was subsequently shared extensively across online hacking communities. The breach contained 24 million unique email addresses alongside extensive personal information including genders, sexualities, dates of birth, physical attributes such as height and weight, religions, ethnicities and political views. The breach also allegedly exposed MD5 password hashes, although the data circulating in hacking circles had this field nulled out. The breach was provided to HIBP by breachbase.pw.
Zooville (zooville.org)
Breach date: 2019-09-27
Accounts affected: 71407
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames
In September 2019, the zoophilia and bestiality forum Zooville suffered a data breach. The usernames and email addresses of 71k members were accessed via an unpatched vulnerability in the vBulletin forum software then subsequently distributed online. A second data set was later provided to HIBP which contained a complete vBulletin database dump including IP addresses, dates of birth and passwords stored as bcrypt hashes. The site administrator advised that following the breach, all data had been deleted from the forum and a new one had been stood up on the XenForo platform.
Zurich (zurich.co.jp)
Breach date: 2023-01-08
Accounts affected: 756737
Data exposed: Dates of birth, Email addresses, Genders, Names, Vehicle details
In January 2023, the Japanese arm of Zurich insurance suffered a data breach that exposed 2.6M customer records with over 756k unique email addresses. The data was subsequently posted to a popular hacking forum and also included names, genders, dates of birth and details of insured vehicles.
Zynga (zynga.com)
Breach date: 2019-09-01
Accounts affected: 172869660
Data exposed: Email addresses, Passwords, Phone numbers, Usernames
In September 2019, game developer Zynga (the creator of Words with Friends) suffered a data breach. The incident exposed 173M unique email addresses alongside usernames and passwords stored as salted SHA-1 hashes. The data was provided to HIBP by dehashed.com.
Медицинская лаборатория Гемотест (Gemotest) (gemotest.ru)
Breach date: 2022-04-22
Accounts affected: 6341495
Data exposed: Dates of birth, Email addresses, Genders, Government issued IDs, Health insurance information, Names, Passport numbers, Physical addresses
In April 2022, Russian pharmaceutical company Gemotest suffered a data breach that exposed 31 million patients. The data contained 6.3 million unique email addresses along with names, physical addresses, dates of birth, passport and insurance numbers. Gemotest was later fined for the breach.
Пара Па (parapa.mail.ru)
Breach date: 2016-08-08
Accounts affected: 4946850
Data exposed: Email addresses, Passwords, Usernames
In August 2016, the Russian gaming site known as Пара Па (or parapa.mail.ru) was hacked along with a number of other forums on the Russian mail provider, mail.ru. The vBulletin forum contained 4.9 million accounts including usernames, email addresses and passwords stored as salted MD5 hashes.
Спрашивай.ру (sprashivai.ru)
Breach date: 2015-05-11
Accounts affected: 3474763
Data exposed: Dates of birth, Email addresses, Genders, Geographic locations, IP addresses, Passwords, Spoken languages
In May 2015, Спрашивай.ру (a the Russian website for anonymous reviews) was reported to have had 6.7 million user details exposed by a hacker known as "w0rm". Intended to be a site for expressing anonymous opinions, the leaked data included email addresses, birth dates and other personally identifiable data about almost 3.5 million unique email addresses found in the leak.
집꾸미기 (ggumim.co.kr)
Breach date: 2020-03-27
Accounts affected: 1298651
Data exposed: Email addresses, Names, Phone numbers, Usernames
In March 2020, the Korean interior decoration website ???? (Decorating the House) suffered a data breach which impacted almost 1.3 million members. Served via the URL ggumim.co.kr, the exposed data included email addresses, names, usernames and phone numbers, all of which was subsequently shared extensively throughout online hacking communities. The data was provided to HIBP by breachbase.pw.