Security Intelligence

Security Intelligence

Known Data Breaches

Hundreds of confirmed breaches. Billions of compromised accounts. Browse the full directory to see how widespread the threat really is, and why proactive
security matters.

Why Browse the Data Breach Directory?

Data breaches are not isolated incidents. They are cumulative. A single person’s credentials can appear in dozens of separate breaches over the years, each one adding more personal details to an attacker’s profile. This directory lets you explore the full scope of confirmed breaches: which companies were hit, how many accounts were exposed, and what types of data were compromised, from email addresses and passwords to financial records and government IDs.

Browsing the catalog puts the scale of the problem into perspective and helps you make informed decisions about which services you trust with your data. If a company you use appears here, that is a direct signal to change your credentials, review your account activity, and consider whether that service deserves continued access to your personal information.

The monthly read on these numbers

Once a month we go through this data and write up what it actually means for a small business. Plain language, no alarm, about five minutes to read. That is the whole newsletter, and you can leave in one click.

A tool by Digital Checkmark

Latest Breach

AfD

afd.de

Breach date: Sep 9, 2026 345,439 accounts affected
In September 2026, the German political party Alternative für Deutschland (AfD) suffered a data breach which exposed 345k unique email addresses. The following month, hundreds of gigabytes of data containing hundreds of thousands of emails and attachments was published online, with searchable AI-generated summaries and downloadable original files. An analysis of the incident reported that the breach was detected as early as 9 September, with a subsequent intrusion occurring five days later. In its public statement, AfD attributed the breach to an attack on a hosting provider, identified in subsequent reporting as the party-owned Alternita Dienstleistungs GmbH.
Email addresses Email messages
1,048 Known Breaches
17.8B Compromised Accounts
166 Data Types Exposed
Showing 1–24 of 1,048 breaches
AfD
afd.de
Sep 9, 2026 345,439 accounts
In September 2026, the German political party Alternative für Deutschland (AfD) suffered a data breach which exposed 345k unique email addresses. The following month, hundreds of gigabytes of data containing hundreds of thousands of emails and attachments was published online, with searchable AI-generated summaries and downloadable original files. An analysis of the incident reported that the breach was detected as early as 9 September, with a subsequent intrusion occurring five days later. In its public statement, AfD attributed the breach to an attack on a hosting provider, identified in subsequent reporting as the party-owned Alternita Dienstleistungs GmbH.
Email addresses Email messages
Assurance Retraite
lassuranceretraite.fr
Sep 1, 2024 70,372 accounts
In September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries. The data included 70k unique email addresses along with names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers (NIR) and contact details of relatives or other nominated contacts. In its disclosure notice, Assurance Retraite attributed the breach to a compromised partner account.
Dates of birth Email addresses Family members' names Government issued IDs Income levels Marital statuses Names Phone numbers Physical addresses
Read our analysis →
Gîtes de France
gites-de-france.com
May 16, 2026 117,574 accounts
In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, including 118k unique email addresses alongside names, phone numbers, postal addresses and booking details.
Booking details Email addresses Names Phone numbers Physical addresses
Crunchbase
crunchbase.com
Jan 22, 2026 559,908 accounts
In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters "pay or leak" extortion attempt. Data allegedly obtained from the company was subsequently published publicly and included 560k unique email addresses, largely belonging to leads and business contacts. Other data included names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. Crunchbase later confirmed that a threat actor had exfiltrated documents from its corporate network.
Email addresses Employers Job titles Names Phone numbers Physical addresses Social media profiles
Read our analysis →
Sharecare
sharecare.com
Aug 12, 2026 318,185 accounts
In August 2026, the digital health company Sharecare was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers. The data also included a small number of Brazilian health insurance plan members, including dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer identification numbers).
Dates of birth Email addresses Employers Genders Government issued IDs Job titles Marital statuses Names Phone numbers Physical addresses
Read our analysis →
Neogen
neogen.com
Aug 29, 2026 435,963 accounts
In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters "pay or leak" extortion attempt. The group later published data it claimed had been obtained from Neogen. The data consisted largely of corporate contact records and included 436k unique email addresses from mailing lists, employee records and other contacts.
Email addresses Employers Job titles Names Phone numbers Physical addresses Salutations
Read our analysis →
CyrusOne
cyrusone.com
Aug 5, 2026 373,460 accounts
In August 2026, data centre operator CyrusOne was the target of a ShinyHunters "pay or leak" extortion attempt. The group subsequently published data allegedly obtained from the company, which included 373k unique email addresses across records relating to users, sales leads and CyrusOne employees. The data largely consisted of corporate contact information, including names, physical addresses, phone numbers and job titles. It also included support tickets and other information related to the organisation's operations.
Email addresses Employers Job titles Names Phone numbers Physical addresses Support tickets
Read our analysis →
Double Counter
doublecounter.gg
Oct 4, 2026 274,922 accounts
In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool. In its disclosure notice, Double Counter advised that attackers gained access to a subset of its data. A corpus of data was subsequently published publicly and contained 275k unique email addresses and Discord usernames. A small number of records belonging to paying subscribers whose purchases were processed via Stripe were also present and included names, countries and postcodes.
Email addresses Geographic locations Names Usernames
Angel One
angelone.in
Apr 1, 2023 6,765,054 accounts
In July 2024, the Indian stock brokerage firm Angel One confirmed that data leaked online related to a breach that occurred in April 2023. The leaked data included 7.9M user records containing 6.8M unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs) and portfolio holdings. Angel One emphasised that the breach "has no impact on client securities, funds, or credentials".
Bank account numbers Dates of birth Email addresses Financial investments Government issued IDs Names Phone numbers Physical addresses
Read our analysis →
Medela
medela.com
Sep 7, 2026 423,947 accounts
In September 2026, Swiss medical device company Medela was the target of a ShinyHunters "pay or leak" extortion campaign. The data allegedly obtained in the breach was later published publicly and included 424k unique email addresses belonging predominantly to healthcare professionals, Medela staff and leads. The exposed data consisted primarily of corporate contact information, including names, physical addresses and phone numbers, with some records also containing associated support tickets.
Email addresses Employers Job titles Names Phone numbers Physical addresses Salutations Support tickets
LimeLeads
limeleads.com
Aug 1, 2019 17,838,396 accounts
In 2019, the now-defunct B2B marketing leads database service LimeLeads suffered a data breach due to an exposed, unsecured Elasticsearch server. The incident exposed tens of millions of records of largely corporate contact data containing 17.8M unique email addresses, along with phone numbers, employers, job titles and geographic locations including state, city and postcode.
Email addresses Employers Geographic locations Job titles Phone numbers
Burger King Russia
burgerkingrus.ru
Aug 25, 2024 3,155,792 accounts
In October 2024, news of a data breach exposing Burger King Russia customers broke following an August attack on the Mindbox marketing automation platform. The breach exposed 3.2M unique email addresses along with names, genders, dates of birth, phone numbers and approximate geolocations, with the data spanning 2018 to August 2024. Burger King Russia acknowledged the incident and advised it did not include payment or passport details.
Dates of birth Email addresses Genders Geographic locations Names Phone numbers
Chess.com (2026)
chess.com
Aug 3, 2026 4,653,212 accounts
In August 2026, millions of records allegedly sourced from Chess.com were posted online. The data contained 7.3M rows with 4.6M unique email addresses, along with usernames, names, countries and data relating to users' Chess.com accounts. Analysis of the data suggested it had been obtained by scraping. When loaded into HIBP, 99% of the email addresses had already appeared in previous data breaches, further supporting the scraping theory. Read more about scrapes and data breaches.
Email addresses Geographic locations Names Usernames
McKesson
mckesson.com
Aug 21, 2026 6,404,340 accounts
In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published a substantial corpus of data they alleged was sourced from the company, which included 6.4M unique email addresses among other personal and corporate data attributes. The impacted data related to a range of individuals and roles, including marketing campaign recipients, patients, staff and healthcare provider contacts. In McKesson's disclosure notice, the company advised it had identified unauthorised access to "certain third-party applications and the exfiltration of certain data was associated with a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units", but had "reasonable assurance of no ongoing unauthorized activity".
Dates of birth Email addresses Employers Genders Names Personal health data Phone numbers Physical addresses
Read our analysis →
Manchester Airports Group
magairports.com
Aug 27, 2026 8,849,657 accounts
In August 2026, Manchester Airports Group (MAG) disclosed a data breach impacting their services. The incident was later claimed by the FulcrumSec hacking group, who subsequently published email addresses and phone numbers relating to 8.8M customers of Manchester, Stansted and East Midlands airports. The data contained personal information relating to airport services, including vehicle registrations and parking history, Fast Track purchases and lounge bookings. In their disclosure notice, MAG advised that "at no point has passenger safety or aviation security been compromised".
Browser user agent details Email addresses Geographic locations IP addresses Names Phone numbers Purchases Vehicle registration plates
Questel
questel.com
Aug 1, 2026 1,226,209 accounts
In August 2026, the French intellectual property software and services company Questel was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published an extensive corpus of data they alleged was obtained from the company, largely comprising corporate contact information associated with sales leads, support cases and marketing activities, with 1.2M unique email addresses. The data also included names, employers and job titles, along with physical addresses and phone numbers.
Email addresses Employers Job titles Names Phone numbers Physical addresses Support tickets
Carhartt
carhartt.com
Aug 13, 2026 12,933,413 accounts
In August 2026, clothing retailer Carhartt was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly obtained from the company including 12.9M unique email addresses, names, phone numbers and physical addresses. The published corpus also contained millions of synthetic records that did not relate to real individuals and were excluded from the breach.
Email addresses Names Phone numbers Physical addresses
NIUS
nius.de
Jul 13, 2025 6,090 accounts
In July 2025, the German news service NIUS suffered a data breach which was subsequently leaked publicly. The data included 6k unique email addresses along with names, physical addresses and payment details for purchases including either IBANs or partial credit card data (masked card number, type and expiry).
Bank account numbers Email addresses Names Partial credit card data Physical addresses Purchases
Golf Canada
golfcanada.ca
May 14, 2026 568,972 accounts
In mid-2026, hundreds of thousands of user records allegedly sourced from Golf Canada began circulating via Telegram. The data included 569k unique email addresses along with names, usernames, dates of birth, genders and approximate geographic locations (city, province and postcode). It remains unclear whether the data was obtained via unintentionally exposed website features or a security vulnerability.
Dates of birth Email addresses Genders Geographic locations Names Usernames
Oz Hair and Beauty
ozhairandbeauty.com
Aug 15, 2026 1,988,331 accounts
In August 2026, Australian beauty retailer Oz Hair and Beauty was the target of an xpl0itrs extortion attack. The group subsequently published data allegedly obtained from the company, which included 2M unique email addresses along with names, phone numbers, geographic locations (suburb and postcode) and purchases.
Email addresses Geographic locations Names Phone numbers Purchases
Fanlore
fanlore.org
Aug 6, 2026 144,520 accounts
In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates. The breach resulted in the exposure of 145k unique email addresses along with usernames and passwords stored as either MD5 or PBKDF2 hashes. OTW self-submitted the exposed data to HIBP.
Email addresses Names Passwords Usernames
RingCentral
ringcentral.com
Jul 27, 2026 1,596,490 accounts
In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they claimed was obtained from the platform, which included 1.6M unique email addresses along with names, physical addresses and phone numbers. In their disclosure notice, RingCentral advised that the incident affected "a limited portion of RingCentral customers" and that it was communicating directly with those affected.
Email addresses Names Phone numbers Physical addresses
Alcon
alcon.com
Aug 1, 2026 218,395 accounts
In August 2026, the Alcon eye care company was named in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly sourced from Alcon containing 218k unique email addresses along with other largely corporate B2B contact fields, including name, phone number and physical address.
Email addresses Names Phone numbers Physical addresses
Brinks Home
brinkshome.com
Jul 13, 2026 732,162 accounts
In July 2026, Brinks Home was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they alleged was taken from the company, including 732k unique email addresses and other personal information relating to leads, customers and Brinks staff such as name, phone numbers and physical addresses. The data also included purchases from Brinks along with partial credit card data (last 4 digits, card type and expiry). In Brinks' disclosure notice, they acknowledged the incident and risk of disclosure, and advised that they would notify impacted parties "consistent with applicable law".
Dates of birth Email addresses Names Partial credit card data Phone numbers Physical addresses Purchases