← Feed

Posts

• View post

  New breach: Substack had 663k records compromised in October and published online this week. Data included email address, phone number and associated public account info. 53% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/Substack

• View post

  New stealer log corpus: A collection of hundreds of millions of stealer log records containing 56M unique email addresses has been added. The data also contained 124M unique passwords added to Pwned Passwords. 86% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/June2026StealerLogs

• View post

  New breach: CFGI was targeted in a ShinyHunters extortion campaign in March. They subsequently published 243k unique email addresses along with names and largely corporate contact information. 53% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/CFGI

• View post

  New breach: The 4th wave of Operation Endgame targeting the SocGholish malware operation resulted in authorities providing 154k email addresses and more than half a million previously unseen passwords to HIBP. 86% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/OperationEndgame4

• View post

  New breach: Ralph Lauren was targeted in a ShinyHunters "pay or leak" extortion campaign. This week, the group published 140k email addresses, names, phone numbers and other personal data. 85% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/RalphLauren

• View post

  New breach: Madison Square Garden Sports was the target of a ShinyHunters extortion campaign earlier this month. Almost 10M email addresses and extensive staff and customer relationship data was later published. 80% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/MadisonSquareGardenSports

• View post

  New breach: American Tower was the target of a ShinyHunters extortion campaign earlier this month. Leaked data included 217k unique email addresses along with names, phone numbers, and addresses. 62% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/AmericanTower

• View post

  New breach: Moody Bible Institute was targeted by a ShinyHunters extortion campaign last month with 2.3M email addresses later published. Data also included name, address, phone and other personal info. 76% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/MoodyBibleInstitute

• View post

  New breach: Houston City College was the target of a ShinyHunters extortion attempt last month. Over 800k unique email addresses were later published with name, physical address, phone number and more. 30% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/HoustonCityCollege

• View post

  New breach: Inter-Con Security was targeted by ShinyHunters in a pay or leak extortion campaign in June. 276k unique email addresses were subsequently published, along with names, physical addresses and more. 44% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/InterConSecurity

• View post

  New sensitive breach: Exact Sciences was targeted by a ShinyHunters extortion campaign last month. The group later published 10.9M email addresses and other personal data, including health information. 75% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/ExactSciences

• View post

  New breach: SplitVPN had 865k unique email addresses breached last week. Data also included IP address, country and partial payment card data. 37% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/SplitVPN

• View post

  New breach: Data from Suno's November 2025 breach surfaced publicly last week. The corpus contained over 55M unique email addresses plus tens of thousands of Stripe payment records. 24% were already in @haveibeenpwned@infosec.exchange. More: https://haveibeenpwned.com/Breach/Suno

• View post

  New breach: Paidwork allegedly suffered a breach in March that was offered for sale before being published this month. Data included profile data, banking info, payout history and bcrypt password hashes. 35% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/Paidwork

• View post

  New breach: Earlier this month, Fluke was targeted in a ShinyHunters extortion campaign. The group published more than 800k email addresses along with largely corporate contact information and support cases. 51% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/Fluke

• View post

  New breach: Last month, some Goose Creek customers received emails claiming a vulnerability and breach. Data later sent to HIBP contained 6.6M email addresses, names, phone numbers and physical addresses. 84% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/GooseCreek

• View post

  New breach: Glendale Community College was the target of a ShinyHunters extortion attempt last month. Nearly 800k unique email addresses were later published with name, physical address, phone number and more. 28% were already in @haveibeenpwned@infosec.exchange. More: https://haveibeenpwned.com/Breach/GlendaleCommunityCollege

• View post

  New breach: Sysco was the target of a ShinyHunters extortion campaign earlier this month. Subsequently published data contained 2.7M unique email addresses plus largely corporate contact information. 44% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/Sysco

• View post

  New breach: JCPenney was targeted by a ShinyHunters extortion campaign that allegedly obtained then leaked data including 368k email addresses, names, SSNs and other HR records on current and former staff. 31% were already in @haveibeenpwned@infosec.exchange. More: https://haveibeenpwned.com/Breach/JCPenney

• View post

  New breach: Cushman & Wakefield was named as a ShinyHunters victim last week, after which mostly corporate contact records were published. Impacted data included email address, job title and company address. 21% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/CushmanWakefield

• View post

  New breach: Canada Life was named as a ShinyHunters victim last month, after which data containing more than 200k email addresses was published. The incident also impacted name, phone number and physical address. 47% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/CanadaLife

• View post

  New breach: Abrigo was targeted by ShinyHunters last month, who subsequently published over 700k unique email addresses allegedly taken from their Salesforce instance. Data also included business contact info. 57% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/Abrigo

• View post

  New breach: Addi was named as a ShinyHunters victim earlier this month and data containing 34M email addresses allegedly obtained from the platform were published. Credit-related data points were also included. 29% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/Addi

• View post

  New breach: Data allegedly taken from CTT, Portugal's postal service, appeared on a hacking forum last month. It contained 468k unique email addresses, along with name, phone number and parcel tracking number. 55% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/CTT

• View post

  New breach: The Windows93 parody site suffered a breach of its Myspace93 sub-site in 2021. The breach exposed 46k email and IP addresses, usernames and plain text passwords. 70% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/Windows93

• View post

  New breach: The Dragonica Lunaris private server suffered a breach in December which exposed 126k email addresses, usernames, dates of birth and bcrypt password hashes. 69% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/Dragonica

• View post

  New breach: 7-Eleven was targeted by the ShinyHunters extortion group last month, with 185k email addresses related to franchisees impacted. Data also included name, physical address, phone number and DoB. 53% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/7-Eleven

• View post

  New breach: Ameriprise was the victim of a ShinyHunters extortion campaign in March. The published data contained 500k email addresses along with names, phone numbers, physical addresses and employer info. 65% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/Ameriprise

• View post

  New breach: Mytheresa was targeted by ShinyHunters in an extortion campaign last month. The leaked data contained 84k email addresses along with name, address, phone, purchase and partial card data. 97% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/Mytheresa

• View post

  New breach: Kemper was targeted by ShinyHunters last month in an extortion campaign resulting in 269k email addresses being published. Data also included names, phone numbers, addresses and partial card data. 53% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/Kemper