lalafo.kg
Disclosed Sep 25, 2026
A database dump from Lalafo (lalafo.kg), a classifieds marketplace popular in Kyrgyzstan and other Central Asian countries. The breach contains approximately 9.5 million user records in MongoDB BSON/JSON format, including usernames, email addresses, mobile phone numbers, avatar URLs, social profile links (Google/Facebook), user hashes, account creation timestamps, and last visit times. Phone numbers appear to include Kyrgyz (+996) and Azerbaijani (+994) numbers among others.
Data found in this dataset
Search this dataset
Team members search this dataset here and through the API. Access is by invitation from your team admin, or by request.
Source files
Expand any file to inspect its column headers and the field each maps to.
lalafo.kg 9.5m+.txt3 columns27,214 rows
File structure
Format: NDJSON
| Source column | Mapped field | Confidence |
|---|---|---|
| mobile | phone | high |
| username | username | high |
| high |
Notes: Lalafo marketplace user records with email, phone, and username as primary PII identifiers.