Tiago2024180/eyewebdataset huggingface dataset:
Muslim Directory (muslimdirectory.co.uk)
Breach date: 2014-02-17
Accounts affected: 37784
Data exposed: Age groups, Email addresses, Employers, Names, Passwords, Phone numbers, Physical addresses, Website activity
In February 2014, the UK guide to services and business known as the Muslim Directory was attacked by the hacker known as @th3inf1d3l. The data was consequently dumped publicly and included the web accounts of tens of thousands of users which contained data including their names, home address, age group, email, website activity and password in plain text.
Muslim Match (muslimmatch.com)
Breach date: 2016-06-24
Accounts affected: 149830
Data exposed: Chat logs, Email addresses, Geographic locations, IP addresses, Passwords, Private messages, User statuses, Usernames
In June 2016, the Muslim Match dating website had 150k email addresses exposed. The data included private chats and messages between relationship seekers and numerous other personal attributes including passwords hashed with MD5.
My Lovely AI (mylovely.ai)
Breach date: 2026-04-07
Accounts affected: 106271
Data exposed: Email addresses, Social media profiles
In April 2026, the NSFW AI girlfriend platform My Lovely AI suffered a data breach that exposed over 100k users. The data included user-created prompts and links to the resulting AI-generated images, along with a small number of Discord and X usernames.
MyFHA (myfha.net)
Breach date: 2015-02-18
Accounts affected: 972629
Data exposed: Credit status information, Email addresses, Income levels, IP addresses, Loan information, Names, Passwords, Personal descriptions, Physical addresses
In approximately February 2015, the home financing website MyFHA suffered a data breach which disclosed the personal information of nearly 1 million people. The data included extensive personal information relating to home financing including personal contact info, credit statuses, household incomes, loan amounts and notes on personal circumstances, often referring to legal issues, divorces and health conditions. Multiple parties contacted HIBP with the data after which MyFHA was alerted in mid-July and acknowledged the legitimacy of the breach then took the site offline.
MyFitnessPal (myfitnesspal.com)
Breach date: 2018-02-01
Accounts affected: 143606147
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In February 2018, the diet and exercise service MyFitnessPal suffered a data breach. The incident exposed 144 million unique email addresses alongside usernames, IP addresses and passwords stored as SHA-1 and bcrypt hashes (the former for earlier accounts, the latter for newer accounts). In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly.
MyHeritage (myheritage.com)
Breach date: 2017-10-26
Accounts affected: 91991358
Data exposed: Email addresses, Passwords
In October 2017, the genealogy website MyHeritage suffered a data breach. The incident was reported 7 months later after a security researcher discovered the data and contacted MyHeritage. In total, more than 92M customer records were exposed and included email addresses and salted SHA-1 password hashes. In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly.
MyPertamina (mypertamina.id)
Breach date: 2022-11-01
Accounts affected: 5970416
Data exposed: Dates of birth, Email addresses, Genders, Names, Phone numbers, Physical addresses, Purchases
In November 2022, the Indonesian oil and gas company Pertamina suffered a data breach of their MyPertamina service. The incident exposed 44M records with 6M unique email addresses along with names, dates of birth, genders, physical addresses and purchases.
myRepoSpace (myrepospace.com)
Breach date: 2015-07-06
Accounts affected: 252751
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In July 2015, the Cydia repository known as myRepoSpace was hacked and user data leaked publicly. Cydia is designed to facilitate the installation of apps on jailbroken iOS devices. The repository service was allegedly hacked by @its_not_herpes and 0x8badfl00d in retaliation for the service refusing to remove pirated tweaks.
MySpace (myspace.com)
Breach date: 2008-07-01
Accounts affected: 359420698
Data exposed: Email addresses, Passwords, Usernames
In approximately 2008, MySpace suffered a data breach that exposed almost 360 million accounts. In May 2016 the data was offered up for sale on the "Real Deal" dark market website and included email addresses, usernames and SHA1 hashes of the first 10 characters of the password converted to lowercase and stored without a salt. The exact breach date is unknown, but analysis of the data suggests it was 8 years before being made public.
MyVidster (2015) (myvidster.com)
Breach date: 2015-08-15
Accounts affected: 19863
Data exposed: Email addresses, Passwords, Usernames
In August 2015, the social video sharing and bookmarking site MyVidster was hacked and nearly 20,000 accounts were dumped online. The dump included usernames, email addresses and hashed passwords.
MyVidster (2025) (myvidster.com)
Breach date: 2025-10-24
Accounts affected: 3864364
Data exposed: Email addresses, Profile photos, Usernames
In October 2025, the data of almost 4M MyVidster users was posted to a public hacking forum. Separate to the 2015 breach, this incident exposed usernames, email addresses and in a small number of cases, profile photos.
Nameless Malware ()
Breach date: 2020-01-01
Accounts affected: 1121484
Data exposed: Email addresses
In January 2021, NordLocker provided HIBP 1.1 million email addresses collected by nameless malware. The malware campaign ran between 2018 and 2020 and infected 3.25 million computers, stealing files, credentials and taking screenshots and photos using the computer's webcam. Read more in NordLocker's writeup about the Nameless malware that stole 1.2 TB of private data.
NapsGear (napsgear.org)
Breach date: 2015-10-21
Accounts affected: 287071
Data exposed: Dates of birth, Email addresses, Genders, Names, Passwords, Phone numbers, Physical addresses, Purchases
In October 2015, the anabolic steroids retailer NapsGear suffered a data breach. An extensive amount of personal information on 287k customers was exposed including email addresses, names, addresses, phone numbers, purchase histories and salted MD5 password hashes.
National Public Data ()
Breach date: 2024-04-09
Accounts affected: 133957569
Data exposed: Dates of birth, Email addresses, Genders, Government issued IDs, Names, Phone numbers, Physical addresses
In April 2024, a large trove of data made headlines as having exposed "3 billion people" due to a breach of the National Public Data background check service. The initial corpus of data released in the breach contained billions of rows of personal information, including US social security numbers. Further partial data sets were later released including extensive personal information and 134M unique email addresses, although the origin and accuracy of the data remains in question. This breach has been flagged as "unverified" and a full description of the incident is in the link above.
Naughty America (naughtyamerica.com)
Breach date: 2016-03-14
Accounts affected: 1398630
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames, Website activity
In March 2016, the adult website Naughty America was hacked and the data consequently sold online. The breach included data from numerous systems with various personal identity attributes, the largest of which had passwords stored as easily crackable MD5 hashes. There were 1.4 million unique email addresses in the breach.
Naz.API ()
Breach date: 2023-09-20
Accounts affected: 70840771
Data exposed: Email addresses, Passwords
In September 2023, over 100GB of stealer logs and credential stuffing lists titled "Naz.API" was posted to a popular hacking forum. The incident contained a combination of email address and plain text password pairs alongside the service they were entered into, and standalone credential pairs obtained from unnamed sources. In total, the corpus of data included 71M unique email addresses and 100M unique passwords.
Neiman Marcus (neimanmarcus.com)
Breach date: 2024-04-14
Accounts affected: 31152842
Data exposed: Dates of birth, Email addresses, IP addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases
In May 2024, the American luxury retailer Neiman Marcus suffered a data breach which was later posted to a popular hacking forum. The data included 31M unique email addresses, names, phone numbers, dates of birth, physical addresses and partial credit card data (note: this is insufficient to make purchases). The breach was traced back to a series of attacks against the Snowflake cloud service which impacted 165 organisations worldwide.
NemoWeb (nemoweb.net)
Breach date: 2016-09-04
Accounts affected: 3472916
Data exposed: Email addresses, Names
In September 2016, almost 21GB of data from the French website used for "standardised and decentralized means of exchange for publishing newsgroup articles" NemoWeb was leaked from what appears to have been an unprotected Mongo DB. The data consisted of a large volume of emails sent to the service and included almost 3.5M unique addresses, albeit many of them auto-generated. Multiple attempts were made to contact the operators of NemoWeb but no response was received.
Neopets (neopets.com)
Breach date: 2013-05-05
Accounts affected: 26892897
Data exposed: Dates of birth, Email addresses, Genders, Geographic locations, IP addresses, Names, Passwords, Usernames
In May 2016, a set of breached data originating from the virtual pet website "Neopets" was found being traded online. Allegedly hacked "several years earlier", the data contains sensitive personal information including birthdates, genders and names as well as almost 27 million unique email addresses. Passwords were stored in plain text and IP addresses were also present in the breach.
NetEase (163.com)
Breach date: 2015-10-19
Accounts affected: 234842089
Data exposed: Email addresses, Passwords
In October 2015, the Chinese site known as NetEase (located at 163.com) was reported as having suffered a data breach that impacted hundreds of millions of subscribers. Whilst there is evidence that the data itself is legitimate (multiple HIBP subscribers confirmed a password they use is in the data), due to the difficulty of emphatically verifying the Chinese breach it has been flagged as "unverified". The data in the breach contains email addresses and plain text passwords. Read more about Chinese data breaches in Have I Been Pwned.
Neteller (neteller.com)
Breach date: 2010-05-17
Accounts affected: 3619948
Data exposed: Account balances, Dates of birth, Email addresses, Genders, IP addresses, Names, Phone numbers, Physical addresses, Security questions and answers, Website activity
In May 2010, the e-wallet service known as Neteller suffered a data breach which exposed over 3.6M customers. The breach was not discovered until October 2015 and included names, email addresses, home addresses and account balances.
NetGalley (netgalley.com)
Breach date: 2020-12-21
Accounts affected: 1436435
Data exposed: Dates of birth, Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
In December 2020, the book promotion site NetGalley suffered a data breach. The incident exposed 1.4 million unique email addresses alongside names, usernames, physical and IP addresses, phone numbers, dates of birth and passwords stored as salted SHA-1 hashes.
Netlog (netlog.com)
Breach date: 2012-11-01
Accounts affected: 49038354
Data exposed: Email addresses, Passwords
In July 2018, the Belgian social networking site Netlog identified a data breach of their systems dating back to November 2012 (PDF). Although the service was discontinued in 2015, the data breach still impacted 49 million subscribers for whom email addresses and plain text passwords were exposed.
NetProspex (netprospex.com)
Breach date: 2016-09-01
Accounts affected: 33698126
Data exposed: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses
In 2016, a list of over 33 million individuals in corporate America sourced from Dun & Bradstreet's NetProspex service was leaked online. D&B believe the targeted marketing data was lost by a customer who purchased it from them. It contained extensive personal and corporate information including names, email addresses, job titles and general information about the employer.
Netshoes (netshoes.com.br)
Breach date: 2017-12-07
Accounts affected: 499836
Data exposed: Dates of birth, Email addresses, Names, Purchases
In December 2017, the online Brazilian retailer known as Netshoes had half a million records allegedly hacked from their system posted publicly. The company was contacted by local Brazilian media outlet Tecmundo and subsequently advised that no indications have been identified of an invasion of the company's systems. However, Netshoes' own systems successfully confirm the presence of matching identifiers and email addresses from the data set, indicating a high likelihood that the data originated from them.
NextGenUpdate (nextgenupdate.com)
Breach date: 2014-04-22
Accounts affected: 1194597
Data exposed: Email addresses, IP addresses, Passwords, Usernames
Early in 2014, the video game website NextGenUpdate reportedly suffered a data breach that disclosed almost 1.2 million accounts. Amongst the data breach was usernames, email addresses, IP addresses and salted and hashed passwords.
Nexus Mods (nexusmods.com)
Breach date: 2013-07-22
Accounts affected: 5915013
Data exposed: Email addresses, Passwords, Usernames
In December 2015, the game modding site Nexus Mods released a statement notifying users that they had been hacked. They subsequently dated the hack as having occurred in July 2013 although there is evidence to suggest the data was being traded months in advance of that. The breach contained usernames, email addresses and passwords stored as a salted hashes.
Nihonomaru (nihonomaru.net)
Breach date: 2015-12-01
Accounts affected: 1697282
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In late 2015, the anime community known as Nihonomaru had their vBulletin forum hacked and 1.7 million accounts exposed. The compromised data included email and IP addresses, usernames and salted hashes of passwords.
Nitro (gonitro.com)
Breach date: 2020-09-28
Accounts affected: 77159696
Data exposed: Email addresses, Names, Passwords
In September 2020, the Nitro PDF service suffered a massive data breach which exposed over 70 million unique email addresses. The breach also exposed names, bcrypt password hashes and the titles of converted documents. The data was provided to HIBP by dehashed.com.
Nival (nival.com)
Breach date: 2016-02-29
Accounts affected: 1535473
Data exposed: Avatars, Dates of birth, Email addresses, Genders, Names, Spoken languages, Usernames, Website activity
In February 2016, the Russian gaming company Nival was the target of an attack which was consequently detailed on Reddit. Allegedly protesting "the foreign policy of Russia in regards to Ukraine", Nival was one of several Russian sites in the breach and impacted over 1.5M accounts including sensitive personal information.
Non Nude Girls (nonnudegirls.org)
Breach date: 2013-05-21
Accounts affected: 75383
Data exposed: Email addresses, IP addresses, Names, Passwords, Usernames, Website activity
In May 2013, the non-consensual voyeurism site "Non Nude Girls" suffered a data breach. The hack of the vBulletin forum led to the exposure of over 75k accounts along with email and IP addresses, names and plain text passwords.
Not Acxiom ()
Breach date: 2020-06-21
Accounts affected: 51730831
Data exposed: Email addresses, IP addresses, Names, Phone numbers, Physical addresses
In 2020, a corpus of data containing almost a quarter of a billion records spanning over 400 different fields was misattributed to database marketing company Acxiom and subsequently circulated within the hacking community. On review, Acxiom concluded that "the claims are indeed false and that the data, which has been readily available across multiple environments, does not come from Acxiom and is in no way the subject of an Acxiom breach". The data contained almost 52M unique email addresses.
Not SOCRadar ()
Breach date: 2024-08-03
Accounts affected: 282478425
Data exposed: Email addresses
In August 2024, over 332M rows of email addresses were posted to a popular hacking forum. The post alleged the addresses were scraped from cybersecurity firm SOCRadar, however an investigation on their behalf concluded that "the actor merely utilised functionalities inherent in the platform's standard offerings, designed to gather information from publicly available sources". There is no suggestion the incident compromised SOCRadar's security or posed any risk to their customers. In total, the data set contained 282M unique addresses of valid email address format.
Nulled.ch (nulled.ch)
Breach date: 2020-05-20
Accounts affected: 43491
Data exposed: Email addresses, IP addresses, Passwords, Private messages, Usernames
In May 2020, the hacking forum Nulled.ch was breached and the data published to a rival hacking forum. Over 43k records were compromised and included IP and email addresses, usernames and passwords stored as salted MD5 hashes alongside the private message history of the website's admin.
Nulled.cr (nulled.cr)
Breach date: 2016-05-06
Accounts affected: 599080
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Private messages, Usernames, Website activity
In May 2016, the cracking community forum known as Nulled.cr was hacked and 599k user accounts were leaked publicly. The compromised data included email and IP addresses, weak salted MD5 password hashes and hundreds of thousands of private messages between members.
NurseryCam (nurserycam.co.uk)
Breach date: 2021-02-12
Accounts affected: 10585
Data exposed: Email addresses
In February 2021, a series of egregiously bad security flaws were identified in the NurseryCam system designed for parents to remotely monitor their children whilst attending nursery. The flaws led to the exposure of over 10k parent records before the service was shut down. The email addresses alone were provided to Have I Been Pwned to ensure parents were properly notified of the incident.
NVIDIA (nvidia.com)
Breach date: 2022-02-23
Accounts affected: 71335
Data exposed: Email addresses, Passwords
In February 2022, microchip company NVIDIA suffered a data breach that exposed employee credentials and proprietary code. Impacted data included over 70k employee email addresses and NTLM password hashes, many of which were subsequently cracked and circulated within the hacking community.
Odido (odido.nl)
Breach date: 2026-02-12
Accounts affected: 6077025
Data exposed: Bank account numbers, Customer service comments, Dates of birth, Driver's licenses, Email addresses, Genders, Government issued IDs, Names, Passport numbers, Phone numbers, Physical addresses
In February 2026, Dutch telco Odido was the victim of a data breach and subsequent extortion attempt. Shortly after, a total of 6M unique email addresses were published across four separate data releases over consecutive days. The exposed data includes names, physical addresses, phone numbers, bank account numbers, dates of birth, customer service notes and passport, driver’s licence and European national ID numbers. Odido has published a disclosure notice including an FAQ to support affected customers.
OGUsers (2019 breach) (ogusers.com)
Breach date: 2018-12-26
Accounts affected: 161143
Data exposed: Email addresses, IP addresses, Passwords, Private messages, Usernames
In May 2019, the account hijacking and SIM swapping forum OGusers suffered a data breach. The breach exposed a database backup from December 2018 which was published on a rival hacking forum. There were 161k unique email addresses spread across 113k forum users and other tables in the database. The exposed data also included usernames, IP addresses, private messages and passwords stored as salted MD5 hashes.
OGUsers (2020 breach) (ogusers.com)
Breach date: 2020-04-02
Accounts affected: 263189
Data exposed: Email addresses, IP addresses, Passwords, Private messages, Usernames
In April 2020, the account hijacking and SIM swapping forum OGUsers suffered their second data breach in less than a year. As with the previous breach, the exposed data included email and IP addresses, usernames, private messages and passwords stored as salted MD5 hashes. A total of 263k email addresses across user accounts and other tables were posted to a rival hacking forum.
OGUsers (2021 breach) (ogusers.com)
Breach date: 2021-04-11
Accounts affected: 348302
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In April 2021, the account hijacking and SIM swapping forum OGusers suffered a data breach, the fourth since December 2018. The breach was subsequently sold on a rival hacking forum and contained usernames, email and IP addresses and passwords stored as either salted MD5 or argon2 hashes. A total of 348k unique email addresses appeared in the breach.
OGUsers (2022 breach) (ogusers.com)
Breach date: 2022-07-13
Accounts affected: 529020
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In July 2022, the account hijacking and SIM swapping forum OGusers suffered a data breach, the fifth since December 2018. The breach contained usernames, email and IP addresses and passwords stored as argon2 hashes. A total of 529k unique email addresses appeared in the breach.
OMGPOP (omgpop.com)
Breach date: 2013-01-01
Accounts affected: 7071293
Data exposed: Email addresses, Passwords
In approximately 2013, the maker of the Draw Something game OMGPOP suffered a data breach. Formerly known as i'minlikewithyou or iilwy and later purchased by Zynga, the breach exposed over 7M email address and plain text password pairs which were later leaked in 2019.
Omnicuris (omnicuris.com)
Breach date: 2025-06-08
Accounts affected: 215298
Data exposed: Email addresses, Geographic locations, Names, Phone numbers
In June 2025, the Indian CME platform Omnicuris suffered a data breach that exposed approximately 200k records of healthcare professionals. The data included names, email addresses, phone numbers, geographic locations and other data attributes relating to professional expertise and training progress. Omnicuris is aware of the incident.
Online Trade (Онлайн Трейд) (onlinetrade.ru)
Breach date: 2022-09-19
Accounts affected: 3805265
Data exposed: Dates of birth, Email addresses, IP addresses, Names, Passwords, Phone numbers
In September 2022, the Russian e-commerce website Online Trade (Онлайн Трейд) suffered a data breach that exposed 3.8M customer records. The data included email and IP addresses, names, phone numbers, dates of birth and MD5 password hashes.
Onliner Spambot ()
Breach date: 2017-08-28
Accounts affected: 711477622
Data exposed: Email addresses, Passwords
In August 2017, a spambot by the name of Onliner Spambot was identified by security researcher Benkow moʞuƎq. The malicious software contained a server-based component located on an IP address in the Netherlands which exposed a large number of files containing personal information. In total, there were 711 million unique email addresses, many of which were also accompanied by corresponding passwords. A full write-up on what data was found is in the blog post titled Inside the Massive 711 Million Record Onliner Spambot Dump.
OnRPG (onrpg.com)
Breach date: 2016-07-01
Accounts affected: 1047640
Data exposed: Email addresses, IP addresses, Passwords, Usernames
In July 2016, the now defunct free online games list website OnRPG suffered a data breach that was later redistributed as part of a larger corpus of data. The incident exposed just over 1M email and IP addresses alongside usernames and passwords stored as salted MD5 hashes.