What the API covers.

A breach of ADT employee/subscriber health insurance eligibility data, sourced from BreachForums. The archive contains highly sensitive records including full names, SSNs, dates of birth, home addresses, phone numbers, email addresses, gender, and health benefit enrollment details. The CSV structure matches a healthcare benefits enrollment file (GROUP_ID 20132) submitted to a health plan. Email domains include adt.com employees as well as other large employers, suggesting this may be data from a third-party benefits administrator or health insurer serving ADT and other companies.

A data breach affecting MasTec, Inc., a large infrastructure construction company. The archive contains highly sensitive employee and benefits enrollment data including full names, Social Security Numbers (SSNs), dates of birth, home addresses, phone numbers, email addresses, gender, ethnicity codes, health insurance plan details, and dependent information. The data appears to be sourced from health benefits enrollment records. It was cleaned and published on BreachForums by the threat actor Nam3L3ss.

A data breach from Pareto.com containing personal information of predominantly Argentine (and some Peruvian) users. The dataset includes full names, national ID numbers (DNI), gender, phone numbers, email addresses, country, and dates of birth. The data is semicolon-delimited and appears to originate from a Spanish-language platform. Distributed via leakeddatabases.com and associated Telegram channel.

A database of approximately 1 million payday/short-term loan applications containing highly sensitive PII including full names, addresses, SSNs, dates of birth, driver's license numbers, bank account numbers, routing numbers, employer information, income details, and IP addresses. The data appears to originate from a payday loan lead generation or lending platform. The filename '41815' may reference a date (April 18, 2015) or an internal identifier.

A large credential compilation file containing approximately 27 million URL:Login:Password (ULP) combos aggregated from stealer logs and prior breaches. The data spans hundreds of different websites and services globally including Google, Facebook, PayPal, Discord, Netflix, Amazon, Riot Games, and many others. This is not a breach of a single target but a compiled credential dump in stealer-log format.

A compilation of approximately 15 million credential records harvested by the Redline information-stealing malware. The data is in URL:login:password (ULP) format and contains credentials from a wide variety of websites including social media (Facebook, Instagram), gaming (Roblox, Minecraft), financial services (PayPal, PerfectMoney), and many others. The records span multiple countries and languages, consistent with a broad infostealer campaign rather than a single targeted breach.

Data breach of the Florida Department of Transportation (FDOT) containing internal operational data including vendor lists with contact information, pre-qualified vendor details with addresses and phone numbers, road construction contracts, active contracts with financial data, CADD system user records with PII (name, address, phone, email), web application user credentials (JetUsers.csv with emails and passwords), browsing/access history logs, transportation coordination system data, and detailed revenue records. The JetUsers.csv file containing email addresses and plaintext passwords is particularly sensitive.

Data breach of Angel One (formerly Angel Broking), an Indian stock brokerage platform. The dataset contains highly sensitive financial data including customer portfolio holdings with stock positions and valuations (as of 2021-08-01), full personal profiles (name, DOB, father's name, PAN number, address, phone, email, bank account details, MICR codes), and profit/loss trading history per user account. Data covers both individual and corporate accounts.

A large compilation of approximately 88 million US consumer records containing personally identifiable information including names, phone numbers, addresses, email addresses, gender, ethnicity, timezone, carrier information, IP addresses, opt-in dates and domains, and line type (mobile/landline). The data appears to originate from a marketing or lead-generation database, with opt-in dates primarily around 2019. Many address and other fields appear to be replaced with numeric IDs, suggesting partial obfuscation or database join artifacts.

Data breach of Betrail (betrail.run), a Belgian trail running platform. The archive contains approximately 2.8 million runner profiles (names, aliases, gender, age, postal codes, cities, countries, registration dates), ~241 user account records (usernames, email addresses, timezones, language preferences, account status, Zitadel SSO IDs), and ~1,500 Stripe invoice/subscription records including customer emails, names, billing details, and payment metadata.

A compilation dataset distributed by threat actor 'Lupin' (Telegram: @LupinIsHere) containing scraped or aggregated business intelligence data from Magento eCommerce platform operators. Files include CSV exports of corporate emails, phone numbers, CRM contacts, and detailed company profiles (revenue, social media, technology stack, employee counts) for hundreds of well-known companies including Bajaj Finance, BBC, Bed Bath & Beyond, Chick-fil-A, Chicago Tribune, Cisco, and others. Data appears to be a commercial B2B intelligence/lead database rather than a traditional credential breach — likely scraped or exfiltrated from a Magento-adjacent analytics or CRM tool.

A breach of PetitesAnnonces.ch, a Swiss classified ads platform. The dataset contains approximately 202,000 advertisement listings including usernames, phone numbers, cities, member-since dates, ad content, and an 'adult category' flag indicating whether the listing is adult-oriented. Data is in French and covers Swiss cantons (VD, GE, BE, NE, VS, FR, JU, etc.).

Data breach from QR&F (Quality Rugs & Furniture), an Australian furniture and rug retailer. The dataset contains two CSV files: one with customer records including names, addresses, phone numbers, email addresses, loyalty points, and account creation dates; and another with sales/order transaction data including product details, pricing, margins, and customer names. Records span from 2019 to April 2025.

A dataset labeled as the US Department of Commerce containing business directory or registry-style records with fields including job title, name, nationality, phone, address, email, fax, and extensive national business identifier fields (EIN, VAT, LEI, CNPJ, etc.) from multiple countries. The data appears to be a global business contacts/registry compilation rather than a direct internal government system breach — it may be sourced from a commercial data aggregator or business registry service associated with or attributed to the Department of Commerce.

A database dump from a website called Fismat, built on the Joomla CMS framework. The archive contains internal web application tables including assets, banners, content, menus, modules, search terms, and other CMS configuration data. No clear user credential data is visible in the sampled files, but the dump exposes the full backend structure of the Joomla-based site.

Dataset containing French healthcare industry transparency data (Sunshine Act / Transparence Santé), recording financial links between pharmaceutical/medical device companies and healthcare professionals, associations, and establishments in France. Fields include beneficiary names, unique identifiers (RPPS/ADELI/SIREN), payment amounts, types of benefits (hospitality, remuneration, conventions), company SIREN numbers, addresses, regions, and publication dates. The data spans multiple semesters from 2022 through 2025. The filename 'SGSocial' suggests this may have been extracted or compiled via the SGSocial platform or a related aggregation tool.

A compiled dataset of approximately 3,500 US individuals containing personal information including full name, home address, city, state, zip code, county, age, gender, phone number, occupation, annual income range, and homeowner status. This appears to be a 'fullz' compilation — aggregated personally identifiable information likely sourced from data brokers or multiple breaches — distributed via a Telegram channel (t.me/LupinIsHere).

Database dump from CECYTE Zacatecas (Colegio de Estudios Científicos y Tecnológicos del Estado de Zacatecas), a Mexican state-run technical education institution. The breach contains multiple SQL database exports including user credentials (bcrypt-hashed passwords), student/staff usernames and emails, course data, attendance records (checador), learning management system data (Chamilo LMS tables), and agency/branch management data. Data spans multiple internal systems including an LMS, attendance tracking system, and agency management platform.

Database dump from pH Electrónica S.A., an Argentine company with over 60 years of experience selling measurement and control instruments. The breach contains the full website database including product categories, brands, newsletter subscribers, user accounts, contact/inquiry forms with customer PII (names, emails, phone numbers, addresses, company names, messages), repair records, and product listings. Contact data dates back to at least 2013.

Database dump from medicina-intensiva.cl, a Chilean intensive medicine website or organization. The archive contains MariaDB/MySQL information_schema metadata including table structures, column definitions, engine configurations, and database schema information. The dump appears to be a full database schema export rather than user data, suggesting this may be a reconnaissance-level or full database exfiltration of a Chilean medical information resource.

A data breach of SpotAngels, a parking app and community platform. The leaked dataset contains user profile information including names, email addresses, IP addresses, phone numbers, device information (device name/model), mobile network carriers, location data (city, state, country), language preferences, parking behavior and history, notification permissions, location permissions, and various app usage analytics. The data appears to be a combination of user account records and event/analytics tracking data.

Data breach from FVET UBA (Facultad de Ciencias Veterinarias, Universidad de Buenos Aires), Argentina's public veterinary school. The archive contains multiple internal database exports including student records (ALUMNO tables with data up to 2025), user accounts, institutional email requests, audit logs, newsletters/events management, and a pharmacy/medication tracking system (hemvfcv_bd). Data spans administrative systems, student enrollment, and internal application management.

Database dump from CONALEP Morelos (Colegio Nacional de Educación Profesional Técnica, Morelos state, Mexico), a Mexican technical education institution. The archive contains extensive CSV exports from internal administrative systems including student attendance records, mailbox/contact messages with personal emails and names, academic certificates, student enrollment data with matriculation numbers, staff/faculty records, payroll data (nomina), contracts, schedules, fingerprint check data, and course/module academic progress records spanning approximately 2011–2022.

WordPress database dump from the French sailing club website APCC Voile Sportive (apccvoilesportive.com). Contains full WordPress database tables including users, posts, comments, metadata, and NextGEN Gallery image data. The data includes user accounts, comment author emails, IP addresses, and site content related to sailing events such as the Women's Cup 2015. Comments date to approximately 2015.

Database breach of Krishna Chandra College (KCC), an Indian educational institution in Birbhum, West Bengal. The leaked data includes alumni details (95 entries with emails, addresses, contact numbers, courses), staff records (71 entries with names, emails, mobile numbers, qualifications, designations), department login credentials (15 departments with salted password hashes), college admin profiles, and user account credentials (3 admin accounts with salted password hashes). The database name is kccolfd5_kccacdb and the domain is kccollege.ac.in / kcc.ac.in.

Database dump from Radiorama (radiorama.com.mx), a Mexican radio network. The archive contains a full MariaDB database export including the information_schema and the www_rad_mx database tables covering admin users, banners, news categories, programming schedules (cartelera), and radio station chains (cadenas).

In October 2026, the Discord server protection and bot service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool. Attackers gained access to a subset of user data including approximately 275,000 unique email addresses and Discord usernames. A small number of records belonging to paying subscribers processed via Stripe also included names, countries, and postcodes. The breach was verified by Have I Been Pwned and subsequently published on PwnForums.

Breach of ServiceLlama, a field service management and invoicing platform. Exposed data includes customer invoicing preferences, invoices with email addresses and phone numbers, user emails, user phone numbers, and user records with full names. Data timestamps extend to mid-2026, suggesting the breach occurred around that time. The dataset contains PII including names, email addresses, phone numbers, invoice amounts, and payment details for what appears to be thousands of customers and service providers.

Database dump from duerninger.de, a German e-commerce retailer running Shopware. The archive contains a full SQL database export with extensive shop data including Klarna payment transaction logs, product configurator data, article/inventory tables, blog content, CMS pages, campaign/newsletter data, and staging environment credentials including plaintext database passwords and HTTP auth credentials. Data spans at least 2020–2024.

Data breach of colec.fr, a French B2B SaaS platform (appears to be a circular economy / waste management / reuse network tool). The archive contains a full database dump including: CRM company records with sales pipeline states, partner listings with contact details and geolocation data, Supabase authentication logs with user email addresses and session tokens, and document photos. Data spans from 2024 through 2026, suggesting this is a relatively recent breach of a live production database.

Breach of the Melbourne International Film Festival (MIFF) database containing customer and member records. Data includes full names, email addresses, phone numbers, physical addresses, purchase amounts, membership types (Single, U26, Concession, Full), membership dates, ticket order details, and event bookings. The four CSV files appear to represent different data exports: ticket purchases, Cinema Nova discount members, general membership records, and member screening event bookings.

A stealer log compilation containing approximately 3.7 million URL:login:password credential triplets harvested from infected machines. The file aggregates credentials across hundreds of unrelated services (Google, LinkedIn, Roblox, Steam, Discord, Apple, TikTok, Facebook, etc.) worldwide. The 'WHITE CLOUD' label in the filename appears to be a threat-actor or distribution brand name for a credential log package, not a single breached entity. The date 29.09.2026 appears in the filename, likely indicating the compilation/release date.

A stealer log compilation distributed via the 'White Cloud' Telegram channel, containing approximately 2 million URL:login:password credential triplets harvested from infostealer malware. The data spans hundreds of different websites and services globally, including social media, gaming, streaming, banking, and e-commerce platforms. The file is formatted as URL:username/email:password and is typical of credential-stuffing databases assembled from infostealer botnet logs.

A stealer log compilation distributed by the 'White Cloud' Telegram channel, containing approximately 1.7 million URL:login:password credential triplets aggregated from infostealer malware. The data spans hundreds of different websites and services globally including Google, PayPal, Roblox, Amazon, Discord, GitHub, and many others. Not a single-company breach — this is a multi-source credential stuffing/stealer log dump.

A credential stuffing / infostealer log compilation distributed via the 'White Cloud' Telegram channel. Contains approximately 975,000 URL:login:password combos harvested from stealer malware across hundreds of different websites including Amazon, Netflix, Google, Epic Games, Discord, LinkedIn, and many others. No single target company — this is a multi-site credential log aggregation typical of infostealer botnet output.

A data breach of TalentPlug, a French ATS (Applicant Tracking System) / recruitment platform. The dataset contains job application records including applicant names, email addresses, phone numbers, job offer details, application sources (LinkedIn, Jooble, etc.), recruitment steps, and attachment metadata (CVs, cover letters). Data appears to be from French job applicants, with job listings in the Nice/Côte d'Azur region among others.

A compilation of plaintext email:password credential pairs predominantly from Hotmail, Outlook, Live, and MSN accounts, along with some Gmail, Yahoo, and other providers. Labeled 'Fresh Hotmail' suggesting it was assembled or circulated as a credential stuffing list. No single breach source is identifiable; this appears to be a stealer log or combo list aggregation targeting Microsoft email accounts.

Data breach of Senheng, a Malaysian consumer electronics retail chain. The dataset contains customer records including loyalty card/member IDs, full names, and email addresses (primary and secondary). Data appears to include both customers and some internal staff email addresses (@senheng.com.my).

A leak of approximately 7.5 million records from Paraguay's electoral registry (Padrón Electoral). Contains personally identifiable information including national ID numbers (cédula), first names, last names, place of birth, profession code, sex, address, neighborhood, marital status, and date of birth for registered voters across Paraguay.

Data breach of the municipal government of Girón, Santander, Colombia (giron-santander.gov.co). The leaked file contains taxpayer and business registry records including NIT/ID numbers, company/individual names, contact persons, addresses, email addresses, and tax classification codes (RETEICA/AUTORETEICA). Data appears to be from the municipal tax administration system.

Database dump from SENAVE (Servicio Nacional de Calidad y Sanidad Vegetal y de Semillas), Paraguay's national plant health and seed quality agency. The archive contains internal system tables from a MECIP (internal control management system) application including users, roles, permissions, organizational departments, directions, procedures, documents, and a WordPress users table. Data includes internal organizational structure, user credentials/accounts, and procedural documentation for the Paraguayan government agency.

Data exfiltration from Houston's 311 citizen services system, containing incident/case records from the City of Houston's Microsoft Dynamics CRM platform. Data includes service request tickets, contact information, addresses, email addresses, GPS coordinates, council districts, case metadata, and operational routing details for city services such as solid waste, recycling, and parks.

Infostealer/RAT compromise of a Varonis employee workstation (hostname MBATAOR-LTS, domain mbataor-lts.varonis.com). The 'Ultron' malware framework exfiltrated system info, network configuration, local user accounts, installed software, running processes, services, environment variables, Chrome credentials, clipboard contents, and sensitive documents including internal Varonis architecture and deployment runbooks (Halcyon, Lockbox, Quarry, Tidepool projects), as well as personal documents belonging to the user 'Miki Bataor' (CV, lease, car service history). Data was collected on 2026-09-17 and uploaded to C2 at 123.168.223.23:8443.

Customer database from Ronis Australia, an Australian retail/e-commerce company. Contains full customer records including names, postal addresses, email addresses, phone numbers, fax numbers, loyalty points balances, price groups, transaction history, and internal customer UIDs. Data spans account creation dates from at least 2022 through late 2025.

Breach of Fanatics (sports merchandise retailer) cloud data estate, including customer balances, bank transaction archives (Japanese and other international), tax exemption certificates, order payment journals, order MN extracts, Kitbag international files, BI reports, holdings inventory, and fraud risk data. Files span dates in 2026. The README indicates the threat actor (handle 'n0n') claims to hold ~218 GB total across ~220K files and is releasing in batches, with a dark web contact URL provided.

A dataset containing auto insurance policyholder records, including insured names, phone numbers, email addresses, physical addresses, driver license details (number, state, DOB, gender, marital status), vehicle information (VIN, make, model, year), and policy details (quote ID, total due, policy effective date, prior insurance status). Data appears to span multiple years with policy effective dates ranging from at least 2018 to 2024. Records are concentrated in Alabama but likely cover broader geography.

Data breach of GSAC Auto Financing containing detailed auto loan and sales records spanning 2017 to 2026. The leaked data includes customer names, vehicle details (VIN, make, model, year), financial information (sale price, amount financed, APR, down payment, gross profit, net profit), and dealer/collector codes. The dataset covers thousands of transactions and exposes sensitive financial and personally identifiable information of car buyers.

A compilation of stealer log credentials distributed via Telegram channel @Xavier_cloud, attributed to @Xavier_Ulp. Contains approximately 314,444 records in URL:username:password format spanning hundreds of different websites including social media, banking, gaming, and government portals. Data appears to be aggregated from infostealer malware infections across multiple countries.

A credential compilation/stealer log dump distributed via Telegram channel @SunCloudNew, post #1820. Contains approximately 1.16 million URL:Login:Password (ULP) combos aggregated from infostealer malware logs across hundreds of different websites and services worldwide, including Google, Apple, Epic Games, Roblox, Twitch, Facebook, government portals, banking sites, and educational institutions.

A dataset containing approximately 137,894 user payment records from an unidentified gaming or subscription platform. Data includes usernames, email addresses, payment IDs, PayPal transaction IDs (EC- prefixed tokens consistent with PayPal), payment amounts, tax amounts, countries, first/last names, and timestamps. Dates in the data appear to be from 2026, suggesting either future-dated records, test data, or a platform with misconfigured timestamps. The usernames and community profile suggest a gaming-related service.

Breach of daryn.online, a Kazakhstani educational platform. The dataset contains approximately 4.2 million records with fields including full name, phone number, email address, date of birth, individual identification number (IIN), region, school name, grade, and year of admission. Data is primarily in Kazakh and Russian, with Kazakhstani phone numbers, indicating the affected users are students and educators across Kazakhstan.

A database dump from Lalafo (lalafo.kg), a classifieds marketplace popular in Kyrgyzstan and other Central Asian countries. The breach contains approximately 9.5 million user records in MongoDB BSON/JSON format, including usernames, email addresses, mobile phone numbers, avatar URLs, social profile links (Google/Facebook), user hashes, account creation timestamps, and last visit times. Phone numbers appear to include Kyrgyz (+996) and Azerbaijani (+994) numbers among others.

Database breach of Futurize Sistemas, a Brazilian software/systems company. The leaked data includes a SQL dump and a CSV export of 'tomadores' (service takers/clients), containing CPF/CNPJ tax identification numbers, company names, fantasy names, municipal and state registration numbers, email addresses, phone numbers, and full addresses including city, state, and ZIP code. The data appears to relate to Brazilian municipalities, businesses, and individuals primarily in the state of Minas Gerais (MG).

A data breach of RIC Publications Australia, an educational publisher. The leaked CSV contains customer order records including full names, email addresses, physical addresses, IP addresses, phone numbers, order amounts, payment method indicators, and purchased product details (Australian curriculum educational materials). Data spans at least 2017–2018.

Internal data from what appears to be a San Francisco residential real estate management company (likely operating under the acronym GCRE). The archive contains tenant security deposit interest calculations, rent board fee records, housing inventory submissions for San Francisco rent-controlled properties (addresses on Filbert, Greenwich, Union, Stanyan, and Taylor Streets), remodel cost summaries, and CCTV/NVR motion detection logs from a Hikvision-style DVR system exported on 2023-05-24. Individual tenant names and financial records are present.

A credential compilation dump distributed via DB Market (dbmarket.pw / dbmarket.app), labeled as update #428 containing approximately 71,300 records. The data consists of email:password pairs predominantly from UK-based email providers (live.co.uk, yahoo.co.uk, hotmail.co.uk) with some international addresses. No single target company is identifiable; this appears to be a credential stuffing compilation or aggregation sold on the DB Market platform.

A credential compilation (update #425) distributed via the DB Market marketplace (dbmarket.pw / dbmarket.app), operated under the handle @STRADU_DB. The file contains approximately 1.7 million email:password pairs aggregated from multiple unknown source breaches. Data is presented in plaintext credential-stuffing list format with wide geographic and domain diversity.

A compilation of approximately 500,000 European email:password credential pairs, distributed by a threat actor using the handle 'Immanuel Kant'. The dataset contains credentials from a wide variety of European email providers and domains (e.g., .de, .fr, .it, .pl, .nl, .es, .bg, .hu, .ro, .cz), suggesting this is an aggregated credential stuffing list rather than a single-source breach.

This dataset contains SMS message logs from Transfast, an international money transfer service. The data includes sequential message IDs, usernames, timestamps, originating/destination phone numbers, country, mobile operator, mobile country/network codes, message content (money transfer notifications), delivery status, and pricing. Messages were sent to recipients in the Philippines, India, Pakistan, Bahrain, and other countries notifying them of money transfers and collection availability.

A breach of McGraw-Hill Education's Salesforce CRM instance (mh.my.site.com), exposing data including customer accounts, contacts, support cases, case comments, partner records, user data, and pricebook history. The data contains educator and student PII including names, emails, phone numbers, school affiliations, and internal support correspondence. Data spans records from approximately 2017 through 2023. Claimed by ShinyHunters with ransom-note flavor text indicating non-payment.

A large dataset containing Dominican Republic citizen records, likely scraped or leaked from the Junta Central Electoral (JCE), the Dominican Republic's civil registry and electoral authority. Data includes full names, national document numbers (cédula), birth dates, nationality IDs, and phone numbers. The response messages 'Consulta exitosa!' (Successful query) suggest this data was harvested via API enumeration rather than a direct database breach. Contains approximately 518 MB of citizen identity records.

A leak of Philippine National Police (PNP) personnel records containing highly sensitive data including full names, ranks, badge numbers, birth dates, blood types, physical descriptions, permanent addresses, official and personal email addresses, mobile numbers, TIN numbers, GSIS/BP numbers, Pag-IBIG numbers, PhilHealth numbers, SALN (Statement of Assets, Liabilities and Net Worth) financial disclosures, family member records, assigned firearms with serial numbers, and promotion histories. The data covers officers across multiple regional offices and units throughout the Philippines.

Breach of Lovee.co, a dating/social app (also referenced as CrushDatingApp internally). Contains approximately 463,000 user records including usernames, email addresses, gender, date of birth, registration timestamps, account status, country/region/city, and GPS coordinates. Some accounts were registered via Facebook OAuth (visible through null.CrushDatingApp.com email patterns). Data spans users from dozens of countries globally.

A compiled database of over 31 million US business contacts containing first name, middle name, last name, job title, company name, mailing address, city, state, ZIP code, country, phone number, website, email address, revenue range, employee count, industry, and sub-industry. The data appears to be a business intelligence or marketing list compilation rather than a breach of a single company.

A data breach affecting an unspecified Peruvian university, exposing two datasets: administrative staff records (including names, emails, gender, registration dates, last access dates, and status) and student records (including full names, DNI national ID numbers, institutional and personal emails, phone numbers, addresses, academic career/area, and enrollment period).

Data breach of the official website and digital services platform of the Municipality of San Pedro, Valle del Cauca, Colombia (sanpedro-valle.gov.co). The leak contains local and global user accounts (392 local, 62 global), citizen-facing government service records including PQRD complaints, construction licenses, cadastral certificates, tax peace-and-save certificates, treasury notifications with full citizen names, government employee/official directories, Keycloak authentication data, park visitor logs (SIMAPI), theft reports (SIMAPI_Robos), and municipal content. Global users include staff from MinTIC, outsourcing support firms, and platform vendors. Data includes full names, usernames, email addresses, government procedure history, and citizen identifiers.

A database breach containing Chilean user records with RUT (Chilean national ID numbers), personal names, email addresses, bcrypt password hashes, phone numbers, birthdates, gender, and profile photo paths. The data appears to reference multiple customer IDs including references to 'penalolen' (Peñalolén municipality) and 'quintaaprueba', suggesting this may be a Chilean civic or government-adjacent platform. Two CSV files were found: one production dataset and one likely staging/signature dataset.

Breach of Intersport (French sporting goods retailer) containing customer data from multiple sources: PayPal transaction records (names, emails, billing/shipping addresses, PayPal transaction IDs), WizVille order data (names, emails, phone numbers, loyalty card numbers, order details), and WizVille in-store review data (user IDs, emails, purchase amounts, star ratings, and French-language comments). Data spans late 2023 through early 2024.

A database of approximately 15.7 million Colombian citizens' records sourced from ICFES (Instituto Colombiano para la Evaluación de la Educación), the Colombian national education evaluation body. The dataset contains national ID numbers (cédulas), full names, email addresses, phone numbers, and the data source attribution (all rows marked 'ICFES'). Data is split across four relational CSV files: personas (identity), emails, telefonos (phones), and fuentes (source attribution).

A credential stuffing compilation (ULP - URL:Login:Password format) distributed via the Telegram channel @kurtxtcloud. Contains approximately thousands of plaintext credential triplets spanning hundreds of different websites globally, including major platforms like Facebook, Amazon, Netflix, Discord, Steam, Instagram, Google, and many regional services across Brazil, Indonesia, Vietnam, Egypt, and other countries. This is not a single-target breach but a multi-source credential compilation aggregated and distributed by a threat actor.

A stealer log compilation distributed via the 'White Cloud' Telegram channel, containing approximately 1.7 million URL:login:password credential triplets. The data appears to be aggregated from infostealer malware targeting primarily German-language users (.de domains dominate), including credentials for Amazon, eBay, PayPal, web.de, and many other German e-commerce and service sites. Format is URL:username/email:password. The date '21.09.2026' in the filename appears to be the distribution date on the channel.

A credential stuffing / stealer log compilation distributed via the 'White Cloud' Telegram channel. Contains approximately 1.9 million URL:login:password triplets harvested from infostealer malware across hundreds of different websites and services worldwide (Google, Facebook, PayPal, Netflix, Amazon, Spotify, Steam, and many others). No single target company — this is a multi-source aggregated stealer log dump.

A dataset of IMVU user account records containing user IDs, usernames, display names, gender, age, country, state, account creation dates, adult verification status, VIP status, creator status, relationship status, orientation, interests, taglines, and avatar image URLs. The data spans accounts from 2004 through at least late 2023. No passwords or emails appear in the sampled fields. The filename tag '@Jaded' likely references the threat actor or leaker handle.

Data breach of Houston Community College (HCCS) systems containing extensive academic and personal records. The archive includes student PII (names, student IDs, birthdates, race, addresses, phone numbers, personal and HCC email addresses, SEVIS IDs for international students, visa types, countries of origin), enrollment records, course schedules, instructor workload data, employee records, vaccination upload files, and financial aid information. Data spans early 2023 timeframe based on file dates.

Breach of Xarxa Santa Tecla, a Catalan healthcare network (part of the Health & Government of Catalonia system). The leaked data includes plaintext system credentials for multiple internal portals, a medical equipment inventory database (229 records from a blood bank/electromedicine unit), and a worker roster with 14 employees including full names, DNI (Spanish national ID numbers), email addresses, and usernames. The threat actors (@keishell, @noname8173) published credentials and internal databases.

Full exfiltration of STOKR's investor database. STOKR is a Luxembourg-based digital investment platform. The breach contains 124 investor records including full names, email addresses, countries, nationalities, KYC status, tax IDs, US accreditation status, document expiry dates, account roles, Stellar wallet addresses, and Ethereum wallet addresses. An enriched dataset also includes 56 Ethereum addresses with 50 verified on-chain.

Internal HR and personnel data breach from the Council of Europe (Conseil de l'Europe). The archive contains internal employee CVs, career histories, personnel records, salary/pay scale data, interpreter contract data, and employee IDs spanning roughly 2006–2019. Files include internal CV documents (French-language), grade/salary tables, and HR system exports.

A massive credential combolist containing approximately 12-13 billion email:password pairs aggregated from multiple prior breaches and credential stuffing sources. Released as a 'special' on the Russian-language hacking forum XSS.IS by threat actors 'Xrenovi4' and 'Aldesa'. The data is a compilation/aggregation rather than a single source breach, containing credentials from a wide variety of global email providers (Gmail, Yahoo, Mail.ru, Rambler, Hotmail, etc.). The dataset spans 38GB in a single large text file.

A leak of U.S. Department of Homeland Security (DHS) and FBI employee directory data, containing names, titles, components, phone numbers, fax numbers, states, and government email addresses (@dhs.gov and associates.dhs.gov domains). The data appears to be an internal staff directory with thousands of entries covering a wide range of roles including IT, security, contracting, legal, and management positions.

A compilation of credentials from multiple private databases, containing usernames, email addresses, SHA1-hashed passwords, and plaintext passwords. The file appears to be a generic credential dump with no identifiable single source or target organization. Data includes users from various email providers (Gmail, Hotmail, Yahoo, etc.) suggesting an aggregated multi-source compilation.

Credential dump from MangaTraders, an online manga reading/trading community. Contains plaintext email and password pairs from user accounts across a variety of email providers. One credential in the dump uses 'mangatraders' as the password, strongly corroborating the source.

A RedLine Stealer malware log archive containing browser-harvested data from multiple infected victims. The archive includes browser autofill data, cookies (from Chrome, Edge, Firefox, Opera, Opera GX, Steam), saved passwords, Discord tokens, credit card data, Steam session files, installed software lists, and screenshots. Victims appear to be primarily German-speaking users based on cookie geolocation data (DE). The data was collected around March-April 2022 based on cookie timestamps. The banner in all files references the RedLine Stealer Telegram support channel (t.me/REDLINESUPPORT). 'Zagum' appears to be a threat-actor or campaign label used to name this particular log batch.

A collection of infostealer logs captured by Raccoon Stealer v1.8.2, compiled around October 2021. The archive contains data from approximately 68,000+ victim machines, organized by IP address and timestamp. Each record includes system information, browser-saved passwords, cookies, autofill data, browsing history, and screenshots. Victims appear to be primarily located in Brazil and Latin America. Sensitive data includes CPF numbers (Brazilian tax IDs), government portal credentials (sefaz.pb.gov.br), email addresses, phone numbers, and browser session cookies.

A compilation of social engineering (SE) fraud guides and tutorials targeting retailers and brands including Amazon, Apple, Dell, Alienware, Beats by Dre, Best Buy, and others. Contains step-by-step instructions for fraudulently obtaining free products, refunds, and gift cards by deceiving customer service representatives. References underground forums such as AstroPID and MagicPID as sources. Not a traditional data breach — this is a leaked/shared fraud methodology archive.

A data breach attributed to Movistar Peru containing customer records with national identity document numbers (DNI/RUC), full names, phone numbers, and geographic location data (address, department, province, district). The data appears to be a customer or subscriber database dump with approximately 433MB of records covering individuals and businesses across Peru.

This is not a breach archive but rather a compilation of password wordlists/dictionaries used for password cracking and security testing. The collection (labeled 'словари' meaning 'dictionaries' in Russian) contains well-known public wordlists including rockyou, phpbb, myspace, hotmail, facebook phishing dumps, alypaa (Finnish site), carders.cc, conficker worm passwords, cain & abel wordlist, and various specialized lists (WPA passwords, fuzzing strings, date-based passwords, web extensions). These are standard pentesting/cracking resources, not a breach of a specific company.

Database breach of Ratakan (ratakan.com), an Indonesian digital product marketplace platform. The dump contains user account data including usernames, emails, and names, as well as extensive platform data covering products, purchases, memberships, subscriptions, sales, activity logs (including plaintext passwords visible in failed login logs), messages, carts, refunds, and payment callbacks. Activity log data begins in February 2020.

Full database dump of SafeUKBank, an online banking platform. The breach contains user accounts, admin credentials (bcrypt-hashed passwords), transaction records, deposit/withdrawal histories, wallet data, notification logs, support tickets, and agent information. Transactions are denominated in BDT (Bangladeshi Taka), suggesting the platform primarily served South Asian users despite the 'UK' branding. The earliest records date to November 17, 2024. The admin email is safeukbank@gmail.com, indicating this may be a smaller or fraudulent/scam banking platform rather than a regulated UK institution.

Exfiltration from PayPal's contact-center network operated by Transcom. The archive contains approximately 75 million network connection/flow records from the contact-center environment, including paypalcorp.com Citrix and authentication system flows, workstation-to-service connection logs, and live database credentials. Data is partitioned across 6 TSV files covering multiple time windows. VLAN labels reference PayPal and Vinted WiFi segments, suggesting a shared Transcom contact-center facility serving multiple clients.

Breach of AudioBee (theaudiobee.com), a platform for audio/voice freelancers. The dataset contains user registration and event tracking data including email addresses, full names, IP addresses, device/browser info, geolocation (city, country, region), platform analytics events (SendGrid email events, page loads), language preferences, and partial profile data (phone, DOB, gender fields). Data appears to span mid-2021. The archive was shared by threat actor 'GoreTerminal'.

Full database dump of JustClean (justclean.com), a laundry and dry-cleaning on-demand platform operating across Kuwait, Saudi Arabia, UAE, Qatar, Bahrain, and other GCC countries. The archive contains 325 files including a full SQL dump and hundreds of CSV exports covering users, addresses, orders, companies, branches, drivers, campaigns, corporate contracts, API keys, payment methods, and operational metadata. Data includes customer delivery addresses with phone numbers and GPS coordinates, internal access keys, and extensive business operations data. Earliest address records date to May 2020.

Full exfiltration of the United Federation of Teachers (UFT) New York legal document management system (West KM). Contains 75,400 named text documents including grievances, arbitration decisions, contracts, and correspondence; 29,476 images; 2,019 PDFs; and document-system indexes including search history and content positions. Member names, case files, and personally identifiable information of union members and employees are included.

Breach of FairMoney, a Nigerian digital lending and financial services platform. The dataset contains financial transaction records including phone numbers, user IDs, agent details, bank names, transaction amounts, transaction types (cash deposits, bill payments), device IMEI numbers, customer names, account numbers, and email addresses. Data appears to be agent-based mobile money transaction logs.

A compilation dataset of approximately 17 million records containing phone numbers (including international format with country codes from multiple countries) paired with plaintext passwords. The data appears to be a credential stuffing list aggregated from multiple sources across many countries, with no single identifiable breach origin.

Data breach of Castella Sport (castella-sport.ch), a Swiss sporting goods retailer. The archive contains email/mailbox data extracted via an email viewer interface, including HTML email files and associated CSV table extracts. The emails appear to be marketing/transactional correspondence, including messages from third-party services like iHerb. The data suggests access to the company's email system or inbox contents.

A data breach affecting Philip Morris International (PMI) employees, primarily from Brazilian operations. The dataset contains internal user records including full names, corporate email addresses (@pmi.com), MD5 and SHA1 hashed passwords with salts, user type IDs, channel IDs, status flags, and timestamps. Emails are predominantly from pmi.com and contracted.pmi.com domains, suggesting this is an internal application or portal database.

Database dump from LivTours (livtours.com), an Italian tour and travel booking platform. The archive contains extensive operational data including booking records, customer addresses, agent details, affiliate information, pricing, addon options, payment methods (PayPal, bank wire, Zelle), commission structures, and tour product configurations. Data is primarily denominated in EUR, consistent with a European travel company.

Full database dump of clicklucestore.it, an Italian online lighting/electronics retail store running on PrestaShop. The breach contains customer personal information including names, addresses, phone numbers, Italian fiscal codes (codice fiscale), VAT numbers, order data, product catalog, cart data, and extensive e-commerce backend tables.

Full database dump of fulker.it, an Italian WooCommerce-based e-commerce website. The breach contains WordPress user accounts with hashed passwords, customer order records including full names, physical addresses, phone numbers, email addresses, IP addresses, and payment method details. Data appears to cover registrations and orders from late 2023 through mid-October 2024.

Data breach affecting RevolutionParts, an automotive parts e-commerce platform. The exposed data includes customer PII such as full names, email addresses, physical addresses, phone numbers, IP addresses, user agent strings, and device information. Records are structured as JSON with internal 'revcloud_person_id' identifiers, suggesting the data originated from RevolutionParts' customer data platform (RevCloud).

A compilation dataset containing US personally identifiable information including full names, Social Security Numbers (SSNs), home addresses, county, state, zip code, phone numbers, dates of birth, and various alias/date fields. The data appears to be sourced from a people-search or data aggregator database, possibly compiled from multiple public records sources.

A small compilation of 73 NASA-related email addresses, 52 phone numbers (many of which appear to be Unix timestamps rather than real phone numbers), and 12 usernames scraped or aggregated from public NASA communications, press contacts, and related sources. The data appears to be publicly scraped contact information rather than a traditional breach of internal systems. Artifacts like malformed entries (e.g., 'Houston281-483-5111leah.d.cheshier@nasa.gov') suggest automated scraping with poor parsing.

A data breach from New Zealand Dream (dreamaupair.co.nz), a New Zealand-based au pair / domestic staffing service. The dataset contains personally identifiable information including titles, first and last names, email addresses, dates of birth, gender, home addresses, postcodes, cities, regions, phone numbers, and IP addresses. Records appear to be New Zealand residents.

WordPress database dump from solomotori.it, an Italian automotive news and information website. The archive contains the full WordPress database including posts, users, user metadata, options, and SEO data. The site covers topics such as car and motorcycle news, driving licenses, and general automotive information.

Full WordPress MySQL database dump from ecommerceguru.it, an Italian e-commerce consulting and education website. The archive contains the complete site database including users, posts, comments, user metadata, login logs, Wordfence security logs, consent records, and plugin data. User credentials, email addresses, IP addresses, and behavioral data are likely present in the users and usermeta tables.

Data breach of Moody Bible Institute (moody.edu) containing alumni and student records including full names, addresses, phone numbers, email addresses, degree information, church affiliations, employee IDs, and purchasing card (PCard) transaction data spanning 2009–2025. Also includes dormitory room assignment lists, alumni account usernames, and PCI-scoped alumni contact data. The autodata_pci files contain weekly alumni data update exports running through late 2025, suggesting the breach may have involved ongoing access to live systems.

A data archive with an obfuscated filename (7f99jn75) containing user records with uid, username, email, signup date, and an extensive array of web-related fields. The target company or service cannot be determined from the available information. The data structure suggests a social platform or web service user database.

A dataset containing Keybase usernames paired with cryptographic signature identifiers and corresponding keybase.io signature URLs. The file appears to be a scrape or export of Keybase user signature chain data. The header contains 'rip@creep.im' suggesting a threat actor or scraper handle. Data includes username, signature hash, and full keybase.io signature URL for each entry.

A small SQL dump containing an affiliate database with password hashes. The single data file contains MD5-hashed passwords (e.g., 5f4dcc3b5aa765d61d8327deb882cf99 is the MD5 hash of 'password'). The archive is only 2.3 KB with minimal data, making it difficult to attribute to a specific company or breach.

A compilation dataset containing highly sensitive US personally identifiable information including full names, addresses, Social Security Numbers (SSNs), dates of birth, driver's license numbers and states, IP addresses, phone numbers, email addresses, net income, bank names, and bank account numbers. The data appears to be sourced from a loan or payday lending application platform based on the 'amt_req' (amount requested) field. No specific breach origin or company is identifiable from the available metadata.

MySQL database dump from eedition.latimes.com containing user account data for the LA Times e-edition platform. Includes first names, last names, usernames, plaintext passwords, email addresses, IP ranges, and account settings. The AUTO_INCREMENT value suggests approximately 117,560 user records.

Breach of GameVN (gamevn.com), a Vietnamese gaming forum/community. The dump contains usernames, email addresses, MD5-hashed passwords, and plaintext passwords in a colon-delimited format. User data includes Vietnamese names and a mix of local and international email providers.

Data breach of Monicare, a childcare/caregiver platform. The breach contains a CSV with personal information (names, emails, phone numbers, addresses, ages) of what appear to be caregivers or job applicants, along with attached documents including driver's licenses, passports, birth certificates, criminal/driving/DCFS background check reports, resumes, recommendation letters, and reference letters. The presence of DCFS (Department of Children and Family Services) reports and background check documents strongly suggests this is a platform connecting families with childcare providers.

Internal operational data from Advacare, a Swiss healthcare consulting/nursing services company. The breach contains staff records with names and email addresses, project management data, expense reports with employee travel reimbursements, task tracking, and timesheet data. Data spans activities from 2021 through at least 2026. The records are in German and Swiss German, referencing Swiss locations and healthcare organizations such as Spitex and Domicil.

A credential combo list containing approximately 5,033 email:password pairs exclusively targeting t-online.de email addresses (Deutsche Telekom's email service). Passwords appear in plaintext, suggesting credentials were aggregated from various sources or phishing campaigns rather than a single direct breach of T-Online infrastructure. The filename 'combo fa target' suggests this is a focused/targeted combo list for t-online.de accounts.

A dataset of approximately 77,000 email addresses associated with Bitmain customers or users. The file contains only email addresses with no passwords or additional PII visible. Bitmain is a major Bitcoin mining hardware manufacturer. The presence of mining-related email handles and a confirmed @bitmain.com internal address (13545574227@bitmain.com) strongly corroborates the target identity.

A large archive of California property tax assessment data aggregated under the domain californiataxdata.com. The dataset contains property tax rolls, parcel assessment records, ownership files, and annual tax roll data from multiple California counties (including Santa Cruz, Ventura, Fresno, San Benito) as well as Florida NAL (Name-Address-Legal) property assessment files from counties such as Charlotte and Glades counties. Data spans multiple years (2005–2025) and includes property owner names, mailing addresses, Social Security Numbers (SSN fields present in FL NAL files), parcel values, exemptions, and tax amounts. The presence of SSN fields in the Florida NAL data is particularly sensitive.

Data breach of Telewave, Inc. (telewave.com), a manufacturer of RF/wireless communications equipment including repeaters, duplexers, and filters. The archive contains internal engineering estimate files, product budgets, customer quotes, and internal CSV/Excel spreadsheets related to product configurations and pricing for customers such as Mann Wireless. Files include model numbers, labor hours, pricing, and customer site data.

Internal data from Cambridge Management Inc, a property management company. The archive contains payroll ACH files with employee names and bank account/routing numbers, internal accounting records, chart of accounts, monthly financial reports, email messages, and operational notes covering 2023–2026. Highly sensitive financial and PII data including full employee banking details.

Data breach of Bijak, an Indian agri-trading platform connecting farmers, traders, and buyers. The dataset contains user profile data including phone numbers, names, city/region, IP addresses, device information, commodities traded, mandi (market) locations, business names, and app usage telemetry events. Data appears to span from mid-2020 through late 2021, with users primarily from India.