Latest Breach Information
Below is a list of the last 25 known data breaches and any information we may have about them.
Harvard
| Added Date: |
11/3/2026 |
| Breach Date: |
11/18/2025 |
| Updated Date: |
11/3/2026 |
| Breach Count: |
850,537 |
| Content: |
Charitable donations, Citizenship statuses, Dates of birth, Education levels, Email addresses, Employers, Ethnicities, Family members' names, Genders, Job titles, Marital statuses, Names, Occupations, Phone numbers, Physical addresses, Places of birth, Salutations, Social media profiles |
| Domain: |
harvard.edu |
Description:
In November 2025, Harvard University suffered a data breach later linked to a ShinyHunters "pay or leak" extortion attempt. The data contained 851k unique email addresses relating to the university's alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students. In Harvard's disclosure notice, the university stated that the breach impacted "personal information such as email addresses, telephone numbers, home and business addresses, event attendance, details of donations to the University, and other biographical information pertaining to University fundraising and alumni engagement activities".
Verified: 
,
Fabricated: 
,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
AfD
| Added Date: |
10/27/2026 |
| Breach Date: |
9/9/2026 |
| Updated Date: |
10/27/2026 |
| Breach Count: |
345,439 |
| Content: |
Email addresses, Email messages |
| Domain: |
afd.de |
Description:
In September 2026, the German political party Alternative für Deutschland (AfD) suffered a data breach which exposed 345k unique email addresses. The following month, hundreds of gigabytes of data containing hundreds of thousands of emails and attachments was published online, with searchable AI-generated summaries and downloadable original files. An analysis of the incident reported that the breach was detected as early as 9 September, with a subsequent intrusion occurring five days later. In its public statement, AfD attributed the breach to an attack on a hosting provider, identified in subsequent reporting as the party-owned Alternita Dienstleistungs GmbH.
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
Assurance Retraite
| Added Date: |
10/19/2026 |
| Breach Date: |
9/1/2024 |
| Updated Date: |
10/19/2026 |
| Breach Count: |
70,372 |
| Content: |
Dates of birth, Email addresses, Family members' names, Government issued IDs, Income levels, Marital statuses, Names, Phone numbers, Physical addresses |
| Domain: |
lassuranceretraite.fr |
Description:
In September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries. The data included 70k unique email addresses along with names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers (NIR) and contact details of relatives or other nominated contacts. In its disclosure notice, Assurance Retraite attributed the breach to a compromised partner account.
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
Gîtes de France
| Added Date: |
10/17/2026 |
| Breach Date: |
5/16/2026 |
| Updated Date: |
10/17/2026 |
| Breach Count: |
117,574 |
| Content: |
Booking details, Email addresses, Names, Phone numbers, Physical addresses |
| Domain: |
gites-de-france.com |
Description:
In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, including 118k unique email addresses alongside names, phone numbers, postal addresses and booking details.
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
Crunchbase
| Added Date: |
10/14/2026 |
| Breach Date: |
1/22/2026 |
| Updated Date: |
10/14/2026 |
| Breach Count: |
559,908 |
| Content: |
Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Social media profiles |
| Domain: |
crunchbase.com |
Description:
In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters "pay or leak" extortion attempt. Data allegedly obtained from the company was subsequently published publicly and included 560k unique email addresses, largely belonging to leads and business contacts. Other data included names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. Crunchbase later confirmed that a threat actor had exfiltrated documents from its corporate network.
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
Sharecare
| Added Date: |
10/12/2026 |
| Breach Date: |
8/12/2026 |
| Updated Date: |
10/12/2026 |
| Breach Count: |
318,185 |
| Content: |
Dates of birth, Email addresses, Employers, Genders, Government issued IDs, Job titles, Marital statuses, Names, Phone numbers, Physical addresses |
| Domain: |
sharecare.com |
Description:
In August 2026, the digital health company Sharecare was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers. The data also included a small number of Brazilian health insurance plan members, including dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer identification numbers).
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
Neogen
| Added Date: |
10/9/2026 |
| Breach Date: |
8/29/2026 |
| Updated Date: |
10/9/2026 |
| Breach Count: |
435,963 |
| Content: |
Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Salutations |
| Domain: |
neogen.com |
Description:
In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters "pay or leak" extortion attempt. The group later published data it claimed had been obtained from Neogen. The data consisted largely of corporate contact records and included 436k unique email addresses from mailing lists, employee records and other contacts.
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
CyrusOne
| Added Date: |
10/7/2026 |
| Breach Date: |
8/5/2026 |
| Updated Date: |
10/7/2026 |
| Breach Count: |
373,460 |
| Content: |
Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets |
| Domain: |
cyrusone.com |
Description:
In August 2026, data centre operator CyrusOne was the target of a ShinyHunters "pay or leak" extortion attempt. The group subsequently published data allegedly obtained from the company, which included 373k unique email addresses across records relating to users, sales leads and CyrusOne employees. The data largely consisted of corporate contact information, including names, physical addresses, phone numbers and job titles. It also included support tickets and other information related to the organisation's operations.
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
Double Counter
| Added Date: |
10/7/2026 |
| Breach Date: |
10/4/2026 |
| Updated Date: |
10/7/2026 |
| Breach Count: |
274,922 |
| Content: |
Email addresses, Geographic locations, Names, Usernames |
| Domain: |
doublecounter.gg |
Description:
In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool. In its disclosure notice, Double Counter advised that attackers gained access to a subset of its data. A corpus of data was subsequently published publicly and contained 275k unique email addresses and Discord usernames. A small number of records belonging to paying subscribers whose purchases were processed via Stripe were also present and included names, countries and postcodes.
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
Angel One
| Added Date: |
10/6/2026 |
| Breach Date: |
4/1/2023 |
| Updated Date: |
10/8/2026 |
| Breach Count: |
6,765,054 |
| Content: |
Bank account numbers, Dates of birth, Email addresses, Financial investments, Government issued IDs, Names, Phone numbers, Physical addresses |
| Domain: |
angelone.in |
Description:
In July 2024, the Indian stock brokerage firm Angel One confirmed that data leaked online related to a breach that occurred in April 2023. The leaked data included 7.9M user records containing 6.8M unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs) and portfolio holdings. Angel One emphasised that the breach "has no impact on client securities, funds, or credentials".
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
Medela
| Added Date: |
9/30/2026 |
| Breach Date: |
9/7/2026 |
| Updated Date: |
9/30/2026 |
| Breach Count: |
423,947 |
| Content: |
Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Salutations, Support tickets |
| Domain: |
medela.com |
Description:
In September 2026, Swiss medical device company Medela was the target of a ShinyHunters "pay or leak" extortion campaign. The data allegedly obtained in the breach was later published publicly and included 424k unique email addresses belonging predominantly to healthcare professionals, Medela staff and leads. The exposed data consisted primarily of corporate contact information, including names, physical addresses and phone numbers, with some records also containing associated support tickets.
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
LimeLeads
| Added Date: |
9/22/2026 |
| Breach Date: |
8/1/2019 |
| Updated Date: |
9/22/2026 |
| Breach Count: |
17,838,396 |
| Content: |
Email addresses, Employers, Geographic locations, Job titles, Phone numbers |
| Domain: |
limeleads.com |
Description:
In 2019, the now-defunct B2B marketing leads database service LimeLeads suffered a data breach due to an exposed, unsecured Elasticsearch server. The incident exposed tens of millions of records of largely corporate contact data containing 17.8M unique email addresses, along with phone numbers, employers, job titles and geographic locations including state, city and postcode.
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
Burger King Russia
| Added Date: |
9/21/2026 |
| Breach Date: |
8/25/2024 |
| Updated Date: |
9/21/2026 |
| Breach Count: |
3,155,792 |
| Content: |
Dates of birth, Email addresses, Genders, Geographic locations, Names, Phone numbers |
| Domain: |
burgerkingrus.ru |
Description:
In October 2024, news of a data breach exposing Burger King Russia customers broke following an August attack on the Mindbox marketing automation platform. The breach exposed 3.2M unique email addresses along with names, genders, dates of birth, phone numbers and approximate geolocations, with the data spanning 2018 to August 2024. Burger King Russia acknowledged the incident and advised it did not include payment or passport details.
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
Chess.com (2026)
| Added Date: |
9/13/2026 |
| Breach Date: |
8/3/2026 |
| Updated Date: |
9/13/2026 |
| Breach Count: |
4,653,212 |
| Content: |
Email addresses, Geographic locations, Names, Usernames |
| Domain: |
chess.com |
Description:
In August 2026, millions of records allegedly sourced from Chess.com were posted online. The data contained 7.3M rows with 4.6M unique email addresses, along with usernames, names, countries and data relating to users' Chess.com accounts. Analysis of the data suggested it had been obtained by scraping. When loaded into HIBP, 99% of the email addresses had already appeared in previous data breaches, further supporting the scraping theory. Read more about scrapes and data breaches.
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
McKesson
| Added Date: |
9/10/2026 |
| Breach Date: |
8/21/2026 |
| Updated Date: |
9/10/2026 |
| Breach Count: |
6,404,340 |
| Content: |
Dates of birth, Email addresses, Employers, Genders, Names, Personal health data, Phone numbers, Physical addresses |
| Domain: |
mckesson.com |
Description:
In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published a substantial corpus of data they alleged was sourced from the company, which included 6.4M unique email addresses among other personal and corporate data attributes. The impacted data related to a range of individuals and roles, including marketing campaign recipients, patients, staff and healthcare provider contacts. In McKesson's disclosure notice, the company advised it had identified unauthorised access to "certain third-party applications and the exfiltration of certain data was associated with a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units", but had "reasonable assurance of no ongoing unauthorized activity".
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
Manchester Airports Group
| Added Date: |
9/2/2026 |
| Breach Date: |
8/27/2026 |
| Updated Date: |
9/2/2026 |
| Breach Count: |
8,849,657 |
| Content: |
Browser user agent details, Email addresses, Geographic locations, IP addresses, Names, Phone numbers, Purchases, Vehicle registration plates |
| Domain: |
magairports.com |
Description:
In August 2026, Manchester Airports Group (MAG) disclosed a data breach impacting their services. The incident was later claimed by the FulcrumSec hacking group, who subsequently published email addresses and phone numbers relating to 8.8M customers of Manchester, Stansted and East Midlands airports. The data contained personal information relating to airport services, including vehicle registrations and parking history, Fast Track purchases and lounge bookings. In their disclosure notice, MAG advised that "at no point has passenger safety or aviation security been compromised".
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
Questel
| Added Date: |
8/31/2026 |
| Breach Date: |
8/1/2026 |
| Updated Date: |
8/31/2026 |
| Breach Count: |
1,226,209 |
| Content: |
Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets |
| Domain: |
questel.com |
Description:
In August 2026, the French intellectual property software and services company Questel was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published an extensive corpus of data they alleged was obtained from the company, largely comprising corporate contact information associated with sales leads, support cases and marketing activities, with 1.2M unique email addresses. The data also included names, employers and job titles, along with physical addresses and phone numbers.
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
Carhartt
| Added Date: |
8/25/2026 |
| Breach Date: |
8/13/2026 |
| Updated Date: |
8/25/2026 |
| Breach Count: |
12,933,413 |
| Content: |
Email addresses, Names, Phone numbers, Physical addresses |
| Domain: |
carhartt.com |
Description:
In August 2026, clothing retailer Carhartt was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly obtained from the company including 12.9M unique email addresses, names, phone numbers and physical addresses. The published corpus also contained millions of synthetic records that did not relate to real individuals and were excluded from the breach.
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
NIUS
| Added Date: |
8/23/2026 |
| Breach Date: |
7/13/2025 |
| Updated Date: |
8/23/2026 |
| Breach Count: |
6,090 |
| Content: |
Bank account numbers, Email addresses, Names, Partial credit card data, Physical addresses, Purchases |
| Domain: |
nius.de |
Description:
In July 2025, the German news service NIUS suffered a data breach which was subsequently leaked publicly. The data included 6k unique email addresses along with names, physical addresses and payment details for purchases including either IBANs or partial credit card data (masked card number, type and expiry).
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List:
Golf Canada
| Added Date: |
8/22/2026 |
| Breach Date: |
5/14/2026 |
| Updated Date: |
9/5/2026 |
| Breach Count: |
568,972 |
| Content: |
Dates of birth, Email addresses, Genders, Geographic locations, Names, Usernames |
| Domain: |
golfcanada.ca |
Description:
In mid-2026, hundreds of thousands of user records allegedly sourced from Golf Canada began circulating via Telegram. The data included 569k unique email addresses along with names, usernames, dates of birth, genders and approximate geographic locations (city, province and postcode). It remains unclear whether the data was obtained via unintentionally exposed website features or a security vulnerability.
Verified: ,
Fabricated: ,
Sensitive: ,
Active: ,
Retired: ,
Is Spam List: