All Breaches published in the Darkweb

3.70 GB | forwarded from: aman iraq - FEMBOYSec.com

https://t.me/+3_DEw0tI2TpmOThk | 3.70 GB | forwarded from: aman iraq - FEMBOYSec.com

https://t.me/+3_DEw0tI2TpmOThk | 3.70 GB | forwarded from: aman iraq - FEMBOYSec.com

3.70 GB | forwarded from: aman iraq - FEMBOYSec.com

3.70 GB | forwarded from: aman iraq - FEMBOYSec.com

3.70 GB | forwarded from: aman iraq - FEMBOYSec.com

3.70 GB | forwarded from: aman iraq - FEMBOYSec.com

3.70 GB | forwarded from: aman iraq - FEMBOYSec.com

3.70 GB | forwarded from: aman iraq - FEMBOYSec.com

3.70 GB | forwarded from: aman iraq - FEMBOYSec.com

3.70 GB | forwarded from: aman iraq - FEMBOYSec.com

3.70 GB | forwarded from: aman iraq - FEMBOYSec.com

3.70 GB | forwarded from: aman iraq - FEMBOYSec.com

https://t.me/+3_DEw0tI2TpmOThk | 3.70 GB | forwarded from: aman iraq - FEMBOYSec.com

https://t.me/+3_DEw0tI2TpmOThk | 32.08 MB | forwarded from: aman iraq - FEMBOYSec.com

Thailand post deadline is expired and you can download the full file. 2.4 million orders and 1.9 million unique citizen records. Every package, every movement, and every detail of your logistics network is now public and everyone can download and use. downloaded from: FEMBOYSec.com join us: https://t.me/+3_DEw0tI2TpmOThk dont lose us: t.me/db_kurdistan & t.me/FEMBOYSec | 156.41 MB | forwarded from: FEMBOYSec Intelligence Agency

ello potatos, we asked their government to contact us, they didnt. and yeah here you are the batch one for free. femboyforum.com join us: https://t.me/+BU7Z-c10QBEwNzk0 uncompressed 3gb+ best compress 250mb country: vietnam ministry of health patients batch one. lines: 4,334,111 Date: 20-7-2026 pass: @FEMBOYSec breached by femboy (@kurdfemboys) | 250.33 MB | forwarded from: FEMBOYSec Intelligence Agency

scrape

This person forgot who he was competing with, he also forgot about this. Owner of breached.st @pal3nt1r has been doxed and we still have a lot more,. maybe the fbi wants that information we are ready to provide it without any charge. For free, FBI, INTERPOL, CIA,EUROPOL COME TO ME THERE'S A NAUGHTY BOY YOU NEED TO CATCH DOX: https://doxbin.com/upload/hasan764dox

In March 2024, a massive data breach was discovered at China UnionPay, the countrys largest payment network. The breach resulted in the exposure of personal and financial information of 637,873,101 individuals, making it one of the largest data leaks in history. The leaked data included names, ID numbers, credit and debit card details, transaction histories, and more. The breach was discovered by a security researcher who notified UnionPay and the authorities. UnionPay confirmed the breach and launched an investigation, but the full extent of the damage is still unknown Total Records: 637,873,101 Region: China Columns: Full Name, Gender, Identity Number, Date Of Birth, Address, card_no File Format: csv

Сформировали базу компаний с положительной чистой прибылью. Подобраны по принципу: есть номер/почта/сайт. Возможен поиск ЛПР по таким или другим параметрам. Связь: Telegram ВКонтакте +79397886929 Яндекс.Мессенджер Отзывы

A 2025 database attributed to the LockBit ransomware group, described as containing approximately 60,000 Bitcoin addresses along with chat logs and credentials.

March 2025, data from Samsung Germany was compromised in a data breach of their logistics provider, Spectos. Allegedly due to credentials being obtained by malware running on a Spectos employee's machine, the breach included 216k unique email addresses along with names, physical addresses, items purchased from Samsung Germany and related support tickets and shipping tracking numbers.

In December 2025, a database of the Brazilian crowdfunding platform APOIA.se was posted to an online forum. In January 2026, the company confirmed it had suffered a data breach. The incident exposed 451k unique email addresses along with names and physical addresses.

Sosltda.com is a Colombian company or website. This entry corresponds to a leaked data set of over 400MB, distributed in PDF and XLSX format, associated with the site. No further verified details about the exact content or breach date are available.

Data attributed to SERECI (Servicio de Registro Civico), the Bolivian public civil registry agency responsible for registering births, marriages, and deaths for Bolivian citizens. The poster states the leak covers roughly 4.6 million records and notes that not all records had finished downloading at the time of posting, so the shared set may be incomplete

A leak attributed to CorseGSM, described in forum discussion as a French mobile telecom provider, dated by commenters to around May 2025 based on a commitment-end-date timestamp field found in the data. Specific fields and record counts are not stated in the source.

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

uid 1 - 16.573 of Winna.com userId, username, incognito, blocked, vipTier, vipLevel, totalWager, totalBets, status, observedAt » 4.193 users include totals, the rest have never played or were incognito always. » The first 152 users have currency ARS, this is my mistake. » Blocked is ban status. uid 1 = first to create an account. uid+1 » Noah Fischer, the silent stakeholder, is uid 12 » 'noah2206'

📂 600k Yahoo Combo List USA Mail Access.txt

#Combo Mail Pass USA YAHOO GMAIL GOOD FOR CRYPTO STREAMING GAMING

#Combo List Yahoo USA 5M

Private yahoo base by stradu

date of breach part1 2025-03-12 part2 2025-03-21 fields: id nombre apellido numeroLinea tipoLinea plan saldo estado mensajeEstado codigoEstado correoElectronico identificacion tipoDocumento permitirPago esAgenteRetencion codigoVIP idCliente 5579618 lines total

Adapass system database (Ministry of Health of Northern Cyprus, 2026) What was leaked: Personal and medical information of 364,036 vaccinated individuals (citizens and foreigners, including tourists). Names, passport details, ID card information, addresses, dates of birth, phone numbers, and vaccination records were exposed online.

Trezor

Breach Date: Dec 2022 Records: 80,000 Fields: names, emails, affiliations, contact information

Cardersplanet.biz is a website whose name is characteristic of an underground 'carding' forum, used for trading stolen payment card and financial data. A database attributed to this domain is dated May 2010.

Carders.cc was a German-based underground hacking and carding forum used to trade stolen payment card data and hacking tools. The forum itself suffered a breach around 2010 that exposed member account data. This leak is dated December 2010.

elitecarders.name appears to be an online forum associated with 'carding' — the trading and fraudulent use of stolen payment-card data. The leak is dated 2016; no further verified details about its scope are available.

Sometime in 2021, data believed to be sourced from LiveRamp (Formerly Acxiom) was leaked online. The data contains extensive information on most people living in the US, including Addresses, Phone numbers, Email addresses, Full names and more. The data is apparently not from Acxiom / / LiveRamp, so the is now free. Anyone who unlocked got their credits refunded. My best guess is its a mashup of consumer leads data. The filename has also been changed from "LiveRamp BF.7z" to "UnknownConsumerData BF.7z". Compromised data: Email addresses, Phone numbers, Full names, Physical addresses. The compressed is 20.8 GB.

A breach of the Chinese operations (on-running.cn) of On-Running, an international shoe brand, claimed by a group calling itself ByteMeCrew as a politically motivated (pro-Palestinian) hack. The post states around 220,000 lines of employee and customer data were recovered, including passwords, email addresses, phone numbers, and other information.

In November 2025, Beckett Collectibles experienced a data breach accompanied by website content defacement. The stolen data was later advertised for sale on a prominent hacking forum, with portions subsequently released publicly. The publicly circulating data initially included more than 500k email addresses reportedly belonging to North American customers, before a larger corpus of over 1M addresses was published the following month. The impacted data included names, usernames, phone numbers and physical addresses.

In October 2025, the data of almost 4M MyVidster users was posted to a public hacking forum. Separate to the 2015 breach, this incident exposed usernames, email addresses and in a small number of cases, profile photos.

In March 2026, the Turkish restaurant chain Baydöner suffered a data breach which was subsequently published to a public hacking forum. The incident exposed over 1.2M unique email addresses along with names, phone numbers, cities of residence and plaintext passwords. A small number of records also included Turkish national ID number and date of birth. In their disclosure notice, Baydöner stated that payment and financial data was not affected.

In May 2026, the GTA V and CS2 cheat service Atlas Menu suffered a data breach. An attacker claimed to have gained access to all Atlas systems and published the service's database to a public GitHub repository. The incident exposed 64k unique email addresses along with usernames, IP addresses, support tickets and passwords stored as bcrypt hashes.

In March 2024, French retailer LDLC disclosed a data breach that impacted customers of their physical stores. The data was previously listed for sale on a popular hacking forum and contained 1.26M unique email addresses along with names, phone numbers and physical addresses.

In June 2024, the investment research company Zacks was allegedly breached, and data was later published to a popular hacking forum. This comes after a separate Zacks data breach confirmed by the organisation in 2023 with the subsequent breach disclosing millions of additional records representing a superset of data from the first incident. The 2024 breach included 12M unique email addresses along with IP and physical addresses, names, usernames, phone numbers and unsalted SHA-256 password hashes. Zacks did not respond to multiple attempts to contact them about the incident.

A breach of attributed to an admin password brute-force attack by the group InfinityBreach, dated 27 January 2026, comprising a single CSV file of 2,597 lines.

In late October 2025, data breached from the Hungarian political party TISZA was published online before being extensively redistributed. Stemming from a compromise of the TISZA Világ service earlier in the month, the breach exposed 200k records of personal data including email addresses along with names, phone numbers and physical addresses.

In December 2025, the dating website "for a Europid vision" WhiteDate suffered a data breach that was subsequently leaked online, initially exposing 6.1k unique email addresses. The leaked data included extensive personal information such as physical appearance, income, education and IQ. A more comprehensive dataset was later provided to HIBP, containing usernames, IP addresses, private messages, phpBB password hashes and a total of 20k unique email addresses.

In November 2024, the South Korean education platform PoinCampus suffered a data breach which was later published to a popular hacking forum. The data included 89k unique email addresses, names and a small number of phone numbers and dates of birth.

In July 2025, the sexual healthcare product maker Hello Cake suffered a data breach. The data was subsequently posted on a public hacking forum and included 23k unique email addresses along with names, phone numbers, physical addresses, dates of birth and purchases.

In November 2024, the German electricity provider Tibber suffered a data breach that exposed the personal information of 50k customers. The data included names, email addresses, geographic locations (city and postcode) and total spend on purchases.

In September 2024, French electronics retailer Boulanger suffered a data breach that exposed over 27M rows of data. The data included 2M unique email addresses along with names, physical addresses, phone numbers and latitude and longitude. The data was later publicly published to a popular hacking forum.

In October 2015, the Chinese site known as NetEase (located at 163.com) was reported as having suffered a data breach that impacted hundreds of millions of subscribers. Whilst there is evidence that the data itself is legitimate (multiple HIBP subscribers confirmed a password they use is in the data), due to the difficulty of emphatically verifying the Chinese breach it has been flagged as "unverified". The data in the breach contains email addresses and plain text passwords. Read more about Chinese data breaches in Have I Been Pwned.

IntelligenceX Pastes — scrape from intelx.io; 46.2M records, breached 2021-08-01. Compromised data: Usernames, Email addresses, pastie.org

A large combolist exposed via an open directory on the domain demo.zeeroq.com, discovered in 2019 and subsequently indexed by Have I Been Pwned. It totaled over 200 million records consisting of email addresses paired with passwords.

A repost of a leaked national citizen database from Peru's RENIEC (Registro Nacional de Identificación y Estado Civil) civil registry. The dataset is described as containing 31 million records in a 9GB CSV file, connected to a RENIEC leak dated 2023/January 2024

In October 2016, the adult entertainment company Friend Finder Networks suffered a massive data breach. The incident impacted multiple separate online assets owned by the company, the largest of which was the Adult FriendFinder website alleged to be "the world's largest sex & swinger community". Exposed data included usernames, passwords stored as SHA-1 hashes and 170 million unique email addresses. This incident is separate to the 2015 data breach Adult FriendFinder also suffered. The data was provided to HIBP by dehashed.com.

pass is skidnigger

In mid-2015, the forum for the hosting provider known as OVH suffered a data breach. The vBulletin forum contained 453k accounts including usernames, email and IP addresses and passwords stored as salted MD5 hashes.

Police National Legal Database UK 135k 2026 DATA SUMMARY: 135k law enforcement contact records with first/last name, email, police force area, etc.

UK Department for Education (education.gov.uk) DATA SUMMARY: Help Portal (~600K records) – Parent and staff contact records containing full names, email addresses, phone numbers, and job titles. Turing Portal (~7K records) – Contact records containing full names, email addresses, phone numbers, and job titles.

Newcastle University (ncl.ac.uk) COUNTRY : GB REVENUE : NA SIZE : 240 MB UNCOMPRESSED ======================================== DATA SUMMARY: 440K~ records containing: applicant and student contact information, significant PII, and admissions data.

Uber Freight uberfreight.com Accounts Payable Dashboard / Documents T3 Accounts Payable Dashboard Documents · 11.66 GB

Bloomsbury writersandartists.co.uk Bloomsbury Publishing plc is a British worldwide publishing house of fiction and non-fiction. Bloomsbury stock is currently trading at 714 GBP per share, and their networth is $578,360,000 GBP (close to $750m USD) The breach includes all users signed up, their email, their full names, and a bit more information. format: json all rows 159910

x67 webshell 😈 🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

SolarWinds ARM / Access Monitoring / Prevent Data Breaches Password: @redbluehit @Hide01 📰 @RedBlueHit 💀👀 @RedBlueTM 🔒

Solar Cell Technology.zip

Пароль: The Breach Structure

Database Includes: Business Name, Category / Industry, Phone Numbers, Website Links, Email Addresses, Country, City, Full Address download link: https://anonfilesnew.com/s/RKU_SGB4o9w

In May 2024, the conservative news website The Post Millennial suffered a data breach. The breach resulted in the defacement of the website and links posted to 3 different corpuses of data including hundreds of writers and editors (IP, physical address and email exposed), tens of thousands of subscribers to the site (name, email, username, phone and plain text password exposed), and tens of millions of email addresses from thousands of mailing lists alleged to have been used by The Post Millennial (this has not been independently verified). The mailing lists appear to be sourced from various campaigns not necessarily run by The Post Millennial and contain a variety of different personal attributes including name, phone and physical address (depending on the campaign). The data was subsequently posted to a popular hacking forum and extensively torrented.

In March 2026, the personal development and achievement media brand SUCCESS suffered a data breach. The incident exposed 250k unique email addresses along with names, IP addresses, phone numbers and, for a limited number of staff members, bcrypt password hashes. The data also included orders containing physical addresses and the payment method used. In SUCCESS' disclosure notice, they advised their system had also been abused to send offensive newsletters with quotes falsely attributed to contributors.

In January 2026, a data breach impacting the French non-profit Association Nationale des Premiers Secours (ANPS) was posted to a hacking forum. The breach exposed 5.6k unique email addresses along with names, dates of birth and places of birth. ANPS self-submitted the data to HIBP and advised the incident was traced back to a legacy system and did not impact health data, financial information or passwords.

4 milion emails

National Public Data (NPD) is a U.S. background-check and people-search data broker. In 2024 it suffered a massive breach, with roughly 2.7 billion records leaked containing names, addresses, dates of birth, and Social Security numbers, later widely circulated on hacking forums as one of the largest personal-data leaks on record.

A dataset scraped from socradar.io consisting solely of email addresses. The original file of 332,970,064 addresses was cleaned, deduplicated and reduced to 282,977,540 unique email addresses; it contains no other personal data fields

In August 2025, over 1M unique email addresses appeared in a breach allegedly obtained from Italian fashion designer Giglio. The data also included names, phone numbers and physical addresses. Giglio did not respond to repeated attempts to disclose the incident.

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

https://www.joyalukkas.com/ae/

Bank Syariah Indonesia (BSI) a state-owned Islamic bank, was breached in 2023 by the LockBit 3.0 ransomware group after refusing to pay ransom, resulting in public exposure of over 7.4 million customer records. Leaked data included over 3.1 million unique email addresses, names, phone numbers and activation codes.

An updated repost of a database attributed to allegromusique.fr, a French site. The poster states this version adds IBAN bank account details that were missing from a prior repost, implying the dataset includes customer/user financial identifiers alongside other existing fields.

A 2024 leak attributed to Fargo, described as a leading logistics service provider in Uzbekistan serving merchants, banks, and e-commerce customers. The dataset, dated October 31, 2024, is said to contain about 980,000 rows covering senders and recipients, including names, multiple phone numbers, full addresses, email, and passport series/number details.

anonfiles anonymous file upload leaking your files since 1980! KEEP IN MIND I HAVEN'T VERIFIED ANYTHING HERE YET! I was bored and crawled this shitty file hoster's indexed links, here is what i've found: Ubisoft.com(Forum): Parkmobile.US: AdultFriendFinder: Xfinity.com: Bitly.com: Aimware: Jobzone.co.il: Everycoin.io: onboarding.SberBank.kz: xHamster Partial: Avast.com Partial: Imgur 1.7M: Void.to: Canva Dehashed(500K): BestBlackhatForum: Elber.com.ua: Mineleaks: Chile GOV: Web-max.ca: Deshosting: Bitcoinnetwork: Shanghai CCP: Some random dumps. 24,113 records.

Database from American Nationwide Mortgage Company (americannationwide.com), a US mortgage lender. Around 1 million of a reported 37 million leaked mortgage-loan records (dated through November 2018) were made available, including name, address, phone, email (partial), gender, age, property purchase/build year, estimated property value, loan amount, issuing bank and loan type.

A voter database from Ukraine shared on a breach forum, reported by the poster to contain approximately 36 million records of voter information.

uos.net.ua, apparently a Ukrainian internet service provider, had a customer database of about 5,000 users (200,000 total lines) dumped. Fields include login credentials, MAC addresses, IP addresses, physical addresses, account balance, connection status, and account passwords

A database attributed to horoshyi.com.ua, dated 10.05.2024, containing 1,205 rows

HackUA.com's name suggests a Ukrainian hacking and security discussion forum. This entry is a leaked database attributed to the site, dated May 2009, with no further public details on scale or exposed data.

In February 2016, the Russian portal and email service KM.RU was the target of an attack which was consequently detailed on Reddit. Allegedly protesting "the foreign policy of Russia in regards to Ukraine", KM.RU was one of several Russian sites in the breach and impacted almost 1.5M accounts including sensitive personal information.

VBerdyanske.net appears to have been a regional community website, likely associated with the city of Berdyansk, Ukraine. This dataset, dated September 2008, is believed to be leaked member account data.

A leak concerning Struktura, a stalkerware developer operating under the UK front company Ersten Group LTD, based in Ukraine. The leaked data covers customers/subscribers of a range of associated stalkerware and tracking products/brands, including phone and account tracking, hacking, and spyware services.

~ 2025

~ 2025

ohrana.ua is a Ukrainian website related to security or guard services ('okhrana' means security/guard in Russian/Ukrainian). This entry is a leaked customer database from the site, dated 2019.

A leak, originally attributed to the Russian hacker group XakNet, described as containing part of the 1C-format database of the Ukrainian payment service NovaPay (formerly Post Finance), linked to the Nova Poshta delivery company. It reportedly holds over 51,500 records of company employees' personal data, including full name, date of birth, DRFO code (tax ID/INN), gender, and email address

In February, the AI-powered comic generation platform KomikoAI suffered a data breach. The incident exposed 1M unique email addresses along with names, user posts and the AI prompts used to generate content. The exposed data enables the mapping of individual AI prompts to specific email addresses.

Data from the Venoy town hall website ( in France, reportedly obtained via SQL injection on 31 January 2026. The leaked file is a small user-account database ("MairieVenoyUtilisateur"), containing about 92 records

In June 2025, 107k unique customer email addresses were allegedly obtained from TheSqua.re, the "easiest way to find your next serviced apartment". The data also included names, phone numbers and cities which were subsequently posted to a popular hacking forum. TheSqua.re did not respond to repeated attempts to disclose the incident, however multiple impacted HIBP subscribers confirmed the legitimacy and accuracy of the data.

📁 Elledecor.com ┏• Date: 2026 ┣• Lines: 256k ┗• Size: 24 Mb 📄 Data: Name,Gender,Address,City,ZIP,Flag,Number,Gender Letter Code,Home Ownership SRC,Birth Year,Month,Day,Approximate Age,Household Income,Net Worth,Residence Type,Race Code,Racial Group,Ethnic Language,Ethnic Religion #USA

In October 2023, the Truist Bank, a leading U.S. commercial bank were breached in an cyberattack and in June 2024, the data was published on BreachForums by @ShinyHunters .The exposed data included over 79k employees unique emails (Work emails) and account balances, dates of birth, job titles, names, partial credit card data and phone numbers. The ShinyHunters themselves commented about this leak - "There is nothing less true than the promises of CrowdShart and in the case of truist the truest words to be said on this subject are when #l0ckb1tch3z! troops taking point on zscaler its #G4M30V3R for them."

8M~ records containing: significant PII, employee and customer contact information, authentication data, password hashes, portal identities, corporate account information, business leads, facilities management records, internal service tickets, and access permissions. Size: 130GB

Alert 360 Opco Inc. Over 2.5M records containing PII and other internal corporate data have been compromised. 10GB+ (compressed)

Salesforce records were compromised and other internal corporate data have been compromised. The company failed to reach an agreement with us despite all the chances and offers we made. They don't care about their clients nor investors. 15GB (compressed)

In August 2025, the French telecommunications company Bouygues Telecom detected a cyber attack against their services. The incident resulted in a data breach that exposed almost 6.4M customer records, including 5.7M unique email addresses. The breach also exposed names, physical addresses, phone numbers, dates of birth and IBANs (International Bank Account Numbers). Bouygues Telecom advised that all affected customers had been notified about the incident.

1 Million Database Phone Number Japan with Provider Records: ~1.1M

Data from the Brazilian Army's SERMIL military conscription portal (sermilweb.eb.mil.br), ~50 million records leaked in October 2025. Fields include full name, full home address, date of birth, CPF, gender, education, father's and mother's names, phone number, email, country and place of birth, army rank and blood type.

Colis Privé, a French shipping and delivery company, had its customer data scraped in November 2025 and subsequently leaked, exposing over 22 million customer records (a reply cites 22,564,381 records, noting duplicate entries for the same people). The data contained more than 12 million unique email addresses along with names, parcel numbers, phone numbers, and physical addresses.

Mon Logiciel Médical, a SaaS-based medical software platform tied to Ameli (France's national health insurance system), had patient data scraped around 2025. Over 19 million patient rows were obtained, including more than 150 thousand unique email addresses, dates of birth, genders, names, phone numbers, and physical addresses.

Easy Cash (France) Easy Cash, a French second-hand goods retailer, suffered a data breach in April 2025 that exposed over 14.6 million rows covering roughly 4.8 million clients. Replies note the file actually contains only around 5,000-5,500 unique email addresses, alongside clients, dates of birth and names.

Revora (forums.revora.net), a gaming forum, suffered a data breach that was publicly exposed in February 2025, affecting over 1.2 million users. Exposed data included email addresses, IP addresses, usernames, and passwords stored as vBulletin hashes

jamendo.com scrape Date: 2026 Records: ~6,5M

Sysco Corporation Over 61 million Salesforce records across several tables, some containing customer data/PII, employee data, and other internal corporate data was compromised.

moody.edu Over 23 gigabytes of Moody Bible Institute data (1,300+ files, tens of millions of records) was compromised across enrollment, donor relations, payroll, and communications systems (MBI, EDC/Salesforce leads, PeopleSoft PS_COMMUNICATION, Horizon SIS, WHPD donor database, and Cadence admissions), including 46 million communication records, 2.2 million enrollment lead records, 108,000 biodemographic master files with addresses and birthdates, 3.3 gigabytes of donor gift data, employee payroll XML with home addresses and earnings, 1,100+ admissions outreach files, and student housing assignment records.

Marcus & Millichap, Inc. Lesk In April 2026, the commercial real estate brokerage firm Marcus & Millichap was named as one of multiple alleged victims of the ShinyHunters hacking and extortion group. Data alleged to have been obtained from the company was subsequently released publicly and included 1.8M unique email addresses, along with names, phone numbers and employment-related information including employer, job title and physical company address. In their disclosure notice, Marcus & Millichap advised that data which may have been accessed appeared limited to "company forms, templates, marketing materials, and general contact information".

In April 2026, online training company Udemy was the victim of a “pay or leak” extortion attempt perpetrated by the ShinyHunters group. The data was subsequently leaked publicly and contained 1.4M unique email addresses belonging to customers and instructors. The data also included names, physical addresses, phone numbers, employer information and instructor payout methods including PayPal, cheque and bank transfer.

Name: Aura Date: March 2026 Records: ~900k Description: In March 2026, the online safety service Aura disclosed a data breach that exposed 900k unique email addresses. The data was primarily associated with a marketing tool from a previously acquired company, with fewer than 20k active Aura customers affected. Exposed data included names, phone numbers, physical and IP addresses, and customer service notes. Aura advised that no Social Security numbers, passwords or financial information were compromised.

Name: Fluke Date: July 2026 Records: ~800k Description: In July 2026, electronic test and measurement equipment company Fluke was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published more than 100GB of data allegedly taken from the company. The corpus contained largely corporate contact information, including over 800k unique email addresses, names, phone numbers and physical addresses. A large collection of support cases was also present.

Watiqa.ma – Moroccan Government Civil Documents Platform Date: May 2026 Format: csv Records: 695,402

Name: Crunchyroll [Fake] Date: March 2026 Records: ~6.8M Description: In March 2026, the anime streaming service Crunchyroll suffered a data breach alleged to have impacted 6.8M users. The exposed data is reported to have originated from the company's Zendesk support system where "name, login name, email address, IP address, general geographic location and the contents of the support tickets" were exposed. A subset of 1.2M email addresses from an alleged 2M record dataset being sold was later provided to HIBP.

Name: LBP-TM.FR Date: January 2026 Records: 3,691,395 Sample: {"Civilite":"MME","Nom":"D ADDETTA","Prenom":"CORALIE","Adresse1":"8 RUE BLANQUI","Adresse2":"","Numero1":"","Numero2":"0668605356","Numero3":"0664991521","Mail":"[email protected]","Code_Postal":"13530","Ville":"Trets","Code_INSEE":"13110","Pays":"1","Prenom_Enfant":"Leo","Jour_Naissance_Enfant":"06","Mois_Naissance_Enfant":"09","Annee_Naissance_enfant":"2010"}

app3.transmitenota.com.br Date: May 01, 2026 Records: 20,151,364 Format: SQL

Name: ADT Size: 10.7 GB Records: 10M+ Description: This dataset is part of a leak concerning the Council of Europe, published by the ShinyHunters group on 18 June 2026 after ransom negotiations failed, following exploitation of an Oracle PeopleSoft zero-day (CVE-2026-35273). The full leak totals roughly 295GB across ~430,000 files and reportedly includes about 409,000 pay slips for over 10,000 current and former employees (2011-2026), CVs, internal HR documents, and banking and tax information. The compromised data content is particularly sensitive: • 409,000 pay slips from over 10,000 current and former employees, covering the period 2011-2026 • 14,000 CVs and 3,700 internal HR documents • Banking information including statements and account numbers • Tax and social security data • Medical records and absence/sickness reports • Performance evaluations and payroll exports • Names, IDs, addresses, phone numbers, and dates of birth of employees

Baker Distributing Company A leak from Baker Distributing Company, attributed to the ShinyHunters group and dated 4 June 2026. It reportedly comprises over 260,000 Salesforce CRM records along with corporate data taken from various SharePoint sites

Nexstar.tv Over 1 million Salesforce records and other internal corporate data containing PII was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. 27GB+ (compressed) 1M+ Records File Size: 26.5 GB

glendale.edu In June 2026, Glendale Community College was the target of a ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from Glendale was later published online and included almost 800k unique email addresses along with various other data fields, including names, addresses, phone numbers, Social Security numbers and other information relating to student enrolments. In its disclosure notice, the college advised that "the potentially impacted information may vary for each individual and may include all or just one of the above-listed types of information".

7-Eleven, Inc. Over 600k Salesforce records containing PII and other internal corporate data have been compromised. Size: 10.4GB+ (compressed) Breach date: Apr 22 ,2026

In March 2026, the financial services firm Ameriprise Financial was named by the ShinyHunters group in a "pay or leak" extortion campaign. The group claimed possession of more than 200GB of compressed data exfiltrated from Ameriprise's Salesforce environment and internal SharePoint infrastructure, and subsequently published the data after negotiations allegedly failed. The published data contained 500k unique email addresses as well as names, phone numbers, physical addresses and employer information. In their disclosure to state attorneys general, Ameriprise reported 47,876 affected people; the larger email address population represents contacts from Ameriprise's broader operational systems, including internal staff. Ameriprise further advised that they have "implemented heightened monitoring of your account(s) to include enhanced identity verification procedures".

In June 2026, the University of Nottingham was the target of a cyber attack, later linked to a ShinyHunters "pay or leak" extortion campaign. Tens of gigabytes of data were subsequently published online and included 455k unique email addresses along with extensive personal information including names, addresses, phone numbers, ethnicities, disabilities, passport numbers and information relating to academic enrolments and fee payments. In a post about the incident, the university advised that the breach affected both "current students, and alumni".

In March 2026, the AI-driven merchant data platform Woflow was named as a victim by the ShinyHunters data extortion group. The group subsequently published tens of thousands of files allegedly obtained from the company, comprising more than 2TB of data. The trove included hundreds of thousands of email addresses, names, phone numbers and physical addresses, with the data indicating it related to Woflow customers and, in turn, the customers of merchants using their platform.