New breach: The China Software Developer Network (CSDN) had 6.4M records breached in 2011. Data included email address, username and plain text password. 80% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/CSDN

New breach: Online coding practice tool CodeStepByStep had 17k records breached last week. Data included name, username and email address. 61% were already in @haveibeenpwned.com . Read more: haveibeenpwned.com/Breach/CodeS...

New breach: In March, 1.8M records allegedly obtained from the ADDA housing societies service was posted to a public hacking forum. Data included email, name, phone and MD5 password hash. 67% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/ADDA

New breach: The International Kiteboarding Organization had 340k records breached this month. Data included email address, name, username and geolocation. 70% were already in @haveibeenpwned.com . Read more: haveibeenpwned.com/Breach/IKO

New breach: Beckett Collectibles experienced a breach and website content defacement this month. A portion of the data leaked publicly, including more than 500k alleged North American email addresses. 84% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Beckett

New breach: Eurofiber France had 10k unique email addresses breached last week in an attack on its ticket management platform. Some records also included name and phone number. 33% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Eurof...

New breach: Vultr had 188k email addresses breached via a security incident at a third-party in 2022. Some records also contained name, IP and country. 44% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Vultr

New breach: The 3rd wave of Operation Endgame targeting infostealer Rhadamanthys, Remote Access Trojan VenomRAT, and botnet Elysium resulted in authorities providing 2M email addresses and 7.4M passwords to HIBP. 34% were already in @haveibeenpwned.com. More: haveibeenpwned.com/Breach/Opera...

New sensitive breach: Hungarian political party TISZA suffered a breach of its TISZA Világ platform last month, exposing 200k records, later published online. Data included email, name, phone & physical address. 41% were already in @haveibeenpwned.com. More: haveibeenpwned.com/Breach/Tisza

New credential stuffing data: Synthient aggregated billions of threat data records from social media, forums, Tor and Telegram. Data included 2B unique email addresses and 1.3B unique passwords. 76% of emails were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Synth...

New breach: Last week, MyVidster had almost 4M user records posted to a public hacking forum. Data included email address, username and in some cases, profile photo. 38% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/breach/MyVid...

New stealer logs: Synthient aggregated billions of threat data records from social media, forums, Tor and Telegram. The stealer log data alone included 183M unique email addresses. 91% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Synth...

New breach: Prosper had 17.6M unique email addresses breached in an incident they detected and disclosed last month. Data included other customer info including SSN. Customer accounts and funds were not impacted. 84% were already in @haveibeenpwned.com. More: haveibeenpwned.com/Breach/Prosper

New sensitive breach: Sexual healthcare product maker Hello Cake had 23k unique email addresses breached in July. Data also included name, phone number, physical address, DoB and purchases. 83% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Hello...

New breach: Today, Scattered LAPSUS$ Hunters published the breach of Vietnam Airlines from June this year. Data included 7.3M unique email addresses along with name, phone, DoB and loyalty membership number. 39% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Vietn...

New breach: Data allegedly obtained from Adpost surfaced in February this year. The data contained 3.3M records of email address, username and display name. 70% were already in @haveibeenpwned.com . Read more: haveibeenpwned.com/Breach/Adpost

New breach: Artists&Clients was breached in August and ransomed for US$50k. The data was then dumped last month and included 95k email addresses, usernames, IP addresses and bcrypt password hashes. 70% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/breach/Artis...

New breach: Now defunct Brazilian e-commerce platform HomeRefill was breached in 2020. Data included 187k unique email address, name, phone number, DoB and salted password hashes. 87% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/breach/HomeR...

New breach: Latest Pilot Jobs had 119k records breached in 2022. Data included email address, username, name and unsalted MD5 password hashes. 81% were already in @haveibeenpwned.com . Read more: haveibeenpwned.com/breach/Lates...

New breach: Cultura had 1.5M unique email addresses breached in September last year. Data also included name, phone number, physical address and orders. 78% were already in @haveibeenpwned.com . Read more: haveibeenpwned.com/Breach/Cultura

New breach: French telco Bouygues Telecom had 5.7M unique email addresses breached last month. Data also included name, physical address, phone number and IBAN. 57% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Bouyg...

In October 2021, now defunct Arabic language Anime website Animeify suffered a data breach that exposed 808k email addresses. Data also included name, username, gender and plain text password. 37% were already in @haveibeenpwned. Read more: haveibeenpwned.com/breach/Anime...

New sensitive breach: Adult website FreeOnes had 960k email addresses breached from their forum in 2017. Data also included username, IP addresses and salted MD5 password hash. 83% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/FreeO...

New breach: Swedish system supplier Miljödata was the victim of a ransomware attack last month. Impacted data included 870k email addresses along with names, physical addresses, DoBs and gov IDs. 11% were already in @haveibeenpwned. Read more: haveibeenpwned.com/breach/Miljo...

New breach: 1M records were allegedly obtained from Italian fashion designer Giglio. Data included email & physical address, name & phone number. Giglio did not respond to repeated attempts to report the breach. 60% were already in @haveibeenpwned. More: haveibeenpwned.com/breach/Giglio

New breach: 107k customer records were allegedly obtained from TheSqua[.]re in June. Data included email, city, name and phone number. TheSqua[.]re did not respond to repeated attempts to report the breach. 65% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/breach/TheSq...

New breach: Allianz Life had 1.1M unique email addresses breached last month via a social engineering attack. Data included name, phone number, physical address, DoB and gender. 72% were already in @haveibeenpwned.com. Read more: haveibeenpwned.com/Breach/Allia...

New stealer logs: In June, news broke of a "16 billion password" breach, though the data turned out to be mostly previously seen stealer logs. 109M unique email addresses have been loaded as "Data Troll", with 96% already in @haveibeenpwned.com. More: haveibeenpwned.com/breach/DataT...

New breach: Unigame (maker of Hunter Online) had 844k records breached in 2019. Impacted data included email addresses and salted MD5 password hashes. 69% were already in @haveibeenpwned.bsky.social. Read more: cybernews.com/security/bil...

New breach: A vulnerability in the GiveWP WordPress plugin exposed the names and email addresses of 30k donors to the Pi-hole network-wide ad blocking project this week. 73% were already in @haveibeenpwned.com. Read more: pi-hole.net/blog/2025/07...

New breach: 160k customer records were allegedly obtained from Creams Cafe in May. Data included email and physical address, name and phone number. Creams Cafe did not respond to repeated attempts to report the breach. 76% were already in @haveibeenpwned.com haveibeenpwned.com

New breach: Thai-language fiction and comics MaReads had 74k records breached last month. Data included email address, username, phone number and DoB. 49% were already in @haveibeenpwned.com haveibeenpwned.com

New breach: Indian CME platform Omnicuris had 200k records breached last month. Data included name, email address, phone number, geolocation and data relating to professional expertise and training progress. 51% were already in @haveibeenpwned.com haveibeenpwned.com

New sensitive breach: Last month, spyware app Catwatchful had 62k records breached via a SQL injection vulnerability that exposed email addresses and plain text passwords. 30% were already in @haveibeenpwned.com. Read more: techcrunch.com/2025/07/02/d...

New breach: In June last year, Robinsons Malls in the Philippines had 195k unique email addresses breached via their mobile app. Data also included name, DoB, gender, phone and city. 43% were already in @haveibeenpwned.com. Read more: www.rappler.com/technology/n...

New breach: Have Fun Teaching had 80k transactions with 27k unique email addresses breached in Aug 2021. Data also included physical and IP address, name, payment method and item purchased. 83% were already in @haveibeenpwned.com haveibeenpwned.com

New breach: South American mobility services platform Ualabee had 472k records scraped last month. Data included email address, name, DoB, phone number and profile photo. 52% were already in @haveibeenpwned.com. Read more: news.ualabee.com/Aclaraci-n-s...

New breach: Now defunct social media influencer platform WiredBucks was breached in 2022. Over 900k email and IP addresses, names, usernames and plain text passwords were exposed. 32% were already in @haveibeenpwned.com. Read more: cybernews.com/security/bil...

New breach: Japanese record chain store Disk Union had 690k email addresses breached in June 2022. Data included name, post code, phone and plain text password. 40% were already in @haveibeenpwned.com. Read more: news.kaduu.io/blog/2022/07...

New breach: ColoCrossing had 7k email addresses breached from their ColoCloud cloud/VPS service last month. Data also included name and MD5-Crypt password hash. 38% were already in @haveibeenpwned.com . Read more: lowendbox.com/blog/coloclo...

New breach: French ISP "Free" was breached in Oct and the data later published publicly. It contains 14M email addresses along with name, physical address, gender, DoB, phone and for many records, IBAN. 59% were already in @haveibeenpwned.com. Read more: www.bleepingcomputer.com/news/securit...

New sensitive breach: The 2nd wave of Operation Endgame to disrupt criminal ransomware infrastructure has resulted in 15.4M email addresses and 43.8M passwords being provided to HIBP by law enforcement agencies. 83% were already in @haveibeenpwned.com. More: www.europol.europa.eu/media-press/...

New breach: Fédération Francaise de Rugby had 282k email addresses breached in June 2023. Data also included name, DoB and phone number. 69% were already in @haveibeenpwned.com. Read more: www.lemonde.fr/sport/articl...

New breach: OnRPG had 1M email addresses breached in 2016. Data also included IP address, username and salted MD5 password hash. 86% were already in @haveibeenpwned.com. Read more: cybernews.com/security/bil...

New breach: Hungarian education office website TehetségKapu had almost 55k records breached in March. Data included email address, name and username. 32% were already in @haveibeenpwned.com. Read more: 444.hu/2025/03/27/5...

New breach: Samsung Germany had 216k unique email addresses exposed due to a compromise of their logistics provider, Spectos. Data included name, physical address, purchases and shipping tracking numbers. 49% were already in @haveibeenpwned.com. Read more: www.infostealers.com/article/sams...

New breach: Indonesian restaurant website Qraved had almost 1M email addresses breached in 2021. Data also included name, phone, DoB and MD5 password hash. 83% were already in @haveibeenpwned.com. Read more: cybernews.com/security/bil...

New breach: French electronics retailer Boulanger had 967k email addresses breached in September. Data also included name, physical address, phone number and lat and long. 65% were already in @haveibeenpwned.com. Read more: therecord.media/france-retai...

New breach: German Doner Kebab had 162k unique email addresses publicly posted to a hacking forum last week. Data also included name, phone and physical addrress. 74% were already in @haveibeenpwned.com. Read more: x.com/DarkWebInfor...

New breach: Troy Hunt's Mailchimp account was successfully phished and a subscriber list for his personal blog was exported. Data included 16k email and IP addresses, plus derived lat long and time zone. 75% were already in @haveibeenpwned.com. Read more: www.troyhunt.com/a-sneaky-phi...