Inteligencia de seguridad

Inteligencia de seguridad

Filtraciones de datos conocidas

Cientos de filtraciones confirmadas. Miles de millones de cuentas comprometidas. Recorre el directorio completo para ver lo extendida que está la amenaza de verdad, y por qué importa la seguridad proactiva.

¿Por qué recorrer el directorio de filtraciones?

Las filtraciones de datos no son incidentes aislados: son acumulativas. Las credenciales de una misma persona pueden aparecer en decenas de filtraciones distintas a lo largo de los años, y cada una añade más detalles personales al perfil que arma el atacante. Este directorio te deja explorar el alcance completo de las filtraciones confirmadas: qué compañías cayeron, cuántas cuentas quedaron expuestas y qué tipos de datos se comprometieron, desde direcciones de correo y contraseñas hasta registros financieros e identificaciones oficiales.

Recorrer el catálogo pone la escala del problema en perspectiva y te ayuda a decidir con información a qué servicios les confías tus datos. Si una compañía que usas aparece aquí, es una señal directa para cambiar tus credenciales, revisar la actividad de tus cuentas y pensar si ese servicio merece seguir teniendo acceso a tu información personal.

La lectura mensual de estas cifras

Una vez al mes repasamos estos datos y escribimos qué significan de verdad para un negocio pequeño. En lenguaje llano, sin alarmismo, unos cinco minutos de lectura. Eso es todo el boletín, y te puedes dar de baja en un clic.

Una herramienta de Digital Checkmark

Última filtración

Crunchbase

crunchbase.com

Fecha de la filtración: 22 Ene 2026 559,908 cuentas afectadas
In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters "pay or leak" extortion attempt. Data allegedly obtained from the company was subsequently published publicly and included 560k unique email addresses, largely belonging to leads and business contacts. Other data included names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. Crunchbase later confirmed that a threat actor had exfiltrated documents from its corporate network.
Direcciones de correo Empleadores Puesto de trabajo Nombres Números de teléfono Direcciones postales Perfiles de redes sociales
1,045 Filtraciones conocidas
17.8B Cuentas comprometidas
165 Tipos de datos expuestos
Mostrando 1–24 de 1,045 filtraciones
Crunchbase
crunchbase.com
22 Ene 2026 559,908 cuentas
In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters "pay or leak" extortion attempt. Data allegedly obtained from the company was subsequently published publicly and included 560k unique email addresses, largely belonging to leads and business contacts. Other data included names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. Crunchbase later confirmed that a threat actor had exfiltrated documents from its corporate network.
Direcciones de correo Empleadores Puesto de trabajo Nombres Números de teléfono Direcciones postales Perfiles de redes sociales
Sharecare
sharecare.com
12 Ago 2026 318,185 cuentas
In August 2026, the digital health company Sharecare was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers. The data also included a small number of Brazilian health insurance plan members, including dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer identification numbers).
Fechas de nacimiento Direcciones de correo Empleadores Género Documentos de identidad oficiales Puesto de trabajo Estado civil Nombres Números de teléfono Direcciones postales
Neogen
neogen.com
29 Ago 2026 435,963 cuentas
In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters "pay or leak" extortion attempt. The group later published data it claimed had been obtained from Neogen. The data consisted largely of corporate contact records and included 436k unique email addresses from mailing lists, employee records and other contacts.
Direcciones de correo Empleadores Puesto de trabajo Nombres Números de teléfono Direcciones postales Tratamientos
Lee nuestro análisis →
CyrusOne
cyrusone.com
5 Ago 2026 373,460 cuentas
In August 2026, data centre operator CyrusOne was the target of a ShinyHunters "pay or leak" extortion attempt. The group subsequently published data allegedly obtained from the company, which included 373k unique email addresses across records relating to users, sales leads and CyrusOne employees. The data largely consisted of corporate contact information, including names, physical addresses, phone numbers and job titles. It also included support tickets and other information related to the organisation's operations.
Direcciones de correo Empleadores Puesto de trabajo Nombres Números de teléfono Direcciones postales Tickets de soporte
Lee nuestro análisis →
Double Counter
doublecounter.gg
4 Oct 2026 274,922 cuentas
In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool. In its disclosure notice, Double Counter advised that attackers gained access to a subset of its data. A corpus of data was subsequently published publicly and contained 275k unique email addresses and Discord usernames. A small number of records belonging to paying subscribers whose purchases were processed via Stripe were also present and included names, countries and postcodes.
Direcciones de correo Ubicación geográfica Nombres Nombres de usuario
Angel One
angelone.in
1 Abr 2023 6,765,054 cuentas
In July 2024, the Indian stock brokerage firm Angel One confirmed that data leaked online related to a breach that occurred in April 2023. The leaked data included 7.9M user records containing 6.8M unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs) and portfolio holdings. Angel One emphasised that the breach "has no impact on client securities, funds, or credentials".
Números de cuenta bancaria Fechas de nacimiento Direcciones de correo Financial investments Documentos de identidad oficiales Nombres Números de teléfono Direcciones postales
Lee nuestro análisis →
Medela
medela.com
7 Sep 2026 423,947 cuentas
In September 2026, Swiss medical device company Medela was the target of a ShinyHunters "pay or leak" extortion campaign. The data allegedly obtained in the breach was later published publicly and included 424k unique email addresses belonging predominantly to healthcare professionals, Medela staff and leads. The exposed data consisted primarily of corporate contact information, including names, physical addresses and phone numbers, with some records also containing associated support tickets.
Direcciones de correo Empleadores Puesto de trabajo Nombres Números de teléfono Direcciones postales Tratamientos Tickets de soporte
LimeLeads
limeleads.com
1 Ago 2019 17,838,396 cuentas
In 2019, the now-defunct B2B marketing leads database service LimeLeads suffered a data breach due to an exposed, unsecured Elasticsearch server. The incident exposed tens of millions of records of largely corporate contact data containing 17.8M unique email addresses, along with phone numbers, employers, job titles and geographic locations including state, city and postcode.
Direcciones de correo Empleadores Ubicación geográfica Puesto de trabajo Números de teléfono
Burger King Russia
burgerkingrus.ru
25 Ago 2024 3,155,792 cuentas
In October 2024, news of a data breach exposing Burger King Russia customers broke following an August attack on the Mindbox marketing automation platform. The breach exposed 3.2M unique email addresses along with names, genders, dates of birth, phone numbers and approximate geolocations, with the data spanning 2018 to August 2024. Burger King Russia acknowledged the incident and advised it did not include payment or passport details.
Fechas de nacimiento Direcciones de correo Género Ubicación geográfica Nombres Números de teléfono
Chess.com (2026)
chess.com
3 Ago 2026 4,653,212 cuentas
In August 2026, millions of records allegedly sourced from Chess.com were posted online. The data contained 7.3M rows with 4.6M unique email addresses, along with usernames, names, countries and data relating to users' Chess.com accounts. Analysis of the data suggested it had been obtained by scraping. When loaded into HIBP, 99% of the email addresses had already appeared in previous data breaches, further supporting the scraping theory. Read more about scrapes and data breaches.
Direcciones de correo Ubicación geográfica Nombres Nombres de usuario
McKesson
mckesson.com
21 Ago 2026 6,404,340 cuentas
In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published a substantial corpus of data they alleged was sourced from the company, which included 6.4M unique email addresses among other personal and corporate data attributes. The impacted data related to a range of individuals and roles, including marketing campaign recipients, patients, staff and healthcare provider contacts. In McKesson's disclosure notice, the company advised it had identified unauthorised access to "certain third-party applications and the exfiltration of certain data was associated with a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units", but had "reasonable assurance of no ongoing unauthorized activity".
Fechas de nacimiento Direcciones de correo Empleadores Género Nombres Datos de salud Números de teléfono Direcciones postales
Lee nuestro análisis →
Manchester Airports Group
magairports.com
27 Ago 2026 8,849,657 cuentas
In August 2026, Manchester Airports Group (MAG) disclosed a data breach impacting their services. The incident was later claimed by the FulcrumSec hacking group, who subsequently published email addresses and phone numbers relating to 8.8M customers of Manchester, Stansted and East Midlands airports. The data contained personal information relating to airport services, including vehicle registrations and parking history, Fast Track purchases and lounge bookings. In their disclosure notice, MAG advised that "at no point has passenger safety or aviation security been compromised".
Datos del navegador Direcciones de correo Ubicación geográfica Direcciones IP Nombres Números de teléfono Compras Vehicle registration plates
Questel
questel.com
1 Ago 2026 1,226,209 cuentas
In August 2026, the French intellectual property software and services company Questel was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published an extensive corpus of data they alleged was obtained from the company, largely comprising corporate contact information associated with sales leads, support cases and marketing activities, with 1.2M unique email addresses. The data also included names, employers and job titles, along with physical addresses and phone numbers.
Direcciones de correo Empleadores Puesto de trabajo Nombres Números de teléfono Direcciones postales Tickets de soporte
Carhartt
carhartt.com
13 Ago 2026 12,933,413 cuentas
In August 2026, clothing retailer Carhartt was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly obtained from the company including 12.9M unique email addresses, names, phone numbers and physical addresses. The published corpus also contained millions of synthetic records that did not relate to real individuals and were excluded from the breach.
Direcciones de correo Nombres Números de teléfono Direcciones postales
NIUS
nius.de
13 Jul 2025 6,090 cuentas
In July 2025, the German news service NIUS suffered a data breach which was subsequently leaked publicly. The data included 6k unique email addresses along with names, physical addresses and payment details for purchases including either IBANs or partial credit card data (masked card number, type and expiry).
Números de cuenta bancaria Direcciones de correo Nombres Datos parciales de tarjeta Direcciones postales Compras
Golf Canada
golfcanada.ca
14 May 2026 568,972 cuentas
In mid-2026, hundreds of thousands of user records allegedly sourced from Golf Canada began circulating via Telegram. The data included 569k unique email addresses along with names, usernames, dates of birth, genders and approximate geographic locations (city, province and postcode). It remains unclear whether the data was obtained via unintentionally exposed website features or a security vulnerability.
Fechas de nacimiento Direcciones de correo Género Ubicación geográfica Nombres Nombres de usuario
Oz Hair and Beauty
ozhairandbeauty.com
15 Ago 2026 1,988,331 cuentas
In August 2026, Australian beauty retailer Oz Hair and Beauty was the target of an xpl0itrs extortion attack. The group subsequently published data allegedly obtained from the company, which included 2M unique email addresses along with names, phone numbers, geographic locations (suburb and postcode) and purchases.
Direcciones de correo Ubicación geográfica Nombres Números de teléfono Compras
Fanlore
fanlore.org
6 Ago 2026 144,520 cuentas
In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates. The breach resulted in the exposure of 145k unique email addresses along with usernames and passwords stored as either MD5 or PBKDF2 hashes. OTW self-submitted the exposed data to HIBP.
Direcciones de correo Nombres Contraseñas Nombres de usuario
RingCentral
ringcentral.com
27 Jul 2026 1,596,490 cuentas
In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they claimed was obtained from the platform, which included 1.6M unique email addresses along with names, physical addresses and phone numbers. In their disclosure notice, RingCentral advised that the incident affected "a limited portion of RingCentral customers" and that it was communicating directly with those affected.
Direcciones de correo Nombres Números de teléfono Direcciones postales
Alcon
alcon.com
1 Ago 2026 218,395 cuentas
In August 2026, the Alcon eye care company was named in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly sourced from Alcon containing 218k unique email addresses along with other largely corporate B2B contact fields, including name, phone number and physical address.
Direcciones de correo Nombres Números de teléfono Direcciones postales
Brinks Home
brinkshome.com
13 Jul 2026 732,162 cuentas
In July 2026, Brinks Home was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they alleged was taken from the company, including 732k unique email addresses and other personal information relating to leads, customers and Brinks staff such as name, phone numbers and physical addresses. The data also included purchases from Brinks along with partial credit card data (last 4 digits, card type and expiry). In Brinks' disclosure notice, they acknowledged the incident and risk of disclosure, and advised that they would notify impacted parties "consistent with applicable law".
Fechas de nacimiento Direcciones de correo Nombres Datos parciales de tarjeta Números de teléfono Direcciones postales Compras
Exact Sciences
exactsciences.com
15 Jul 2026 10,869,543 cuentas
In July 2026, Exact Sciences (now owned by Abbott Laboratories) was the target of a ShinyHunters "pay or leak" extortion campaign. The group claimed to have obtained data from the company's cancer diagnostics business, which they later published publicly. The breach contained 10.9M unique email addresses belonging to customers, patients and healthcare providers, along with names, addresses, phone numbers and health records. Abbott subsequently published a public notice advising that "some of the impacted files contain personal information and/or personal health information" and that more specific information would follow once their review of the incident was complete. For context, Exact Sciences is the maker of the Cologuard at-home colorectal cancer screening test.
Fechas de nacimiento Direcciones de correo Género Nombres Datos de salud Números de teléfono Direcciones postales
Inter-Con Security
icsecurity.com
18 Jun 2026 276,114 cuentas
In June 2026, Inter-Con Security was targeted in a ShinyHunters “pay or leak” extortion campaign. The group subsequently published data it alleged was taken from the company, including 276k unique email addresses along with names, physical addresses, job titles and phone numbers. The data encompassed a combination of contacts, internal users and leads.
Direcciones de correo Empleadores Puesto de trabajo Nombres Números de teléfono Direcciones postales
SplitVPN
splitvpn.io
21 Jul 2026 865,336 cuentas
In July 2026, the Russian VPN service SplitVPN (previously known as NotVPN) suffered a data breach. The incident exposed millions of customer records, including 865k unique email addresses. Other impacted data included IP addresses, the user's country, and partial payment card data (first 6 and last 4 digits plus expiry date).
Datos del dispositivo Direcciones de correo Ubicación geográfica Direcciones IP Datos parciales de tarjeta