| Risiko / Label | Veröffentlichung | |
|---|---|---|
| Risiko ? / 10 | vor 490035 Stunde(n) | |
| Risiko ? / 10 MAL-2025-191358 | vor 490035 Stunde(n) | |
| Malicious code in @voiceflow/nestjs-mongodb (npm) | ||
| Risiko ? / 10 MAL-2025-191357 | vor 490035 Stunde(n) | |
| Malicious code in @voiceflow/nestjs-common (npm) | ||
| Risiko ? / 10 MAL-2025-191356 | vor 490035 Stunde(n) | |
| Malicious code in @voiceflow/natural-language-commander (npm) | ||
| Risiko ? / 10 MAL-2025-191355 | vor 490035 Stunde(n) | |
| Malicious code in @voiceflow/metrics (npm) | ||
| Risiko ? / 10 MAL-2025-191354 | vor 490035 Stunde(n) | |
| Malicious code in @voiceflow/logger (npm) | ||
| Risiko ? / 10 MAL-2025-191353 | vor 490035 Stunde(n) | |
| Malicious code in @voiceflow/husky-config (npm) | ||
| Risiko ? / 10 MAL-2025-191352 | vor 490035 Stunde(n) | |
| Malicious code in @voiceflow/google-types (npm) | ||
| Risiko ? / 10 MAL-2025-191351 | vor 490035 Stunde(n) | |
| Malicious code in @voiceflow/google-dfes-types (npm) | ||
| Risiko ? / 10 MAL-2025-191350 | vor 490035 Stunde(n) | |
| Malicious code in @voiceflow/git-branch-check (npm) | ||
| Risiko ? / 10 MAL-2025-191349 | vor 490035 Stunde(n) | |
| Malicious code in @voiceflow/general-types (npm) | ||
| Risiko ? / 10 MAL-2025-191348 | vor 490035 Stunde(n) | |
| Malicious code in @voiceflow/fetch (npm) | ||
| Risiko ? / 10 MAL-2025-191347 | vor 490035 Stunde(n) | |
| Malicious code in @voiceflow/exception (npm) | ||
| Risiko ? / 10 MAL-2025-191346 | vor 490035 Stunde(n) | |
| Malicious code in @voiceflow/eslint-plugin (npm) | ||
| Risiko ? / 10 MAL-2025-191345 | vor 490035 Stunde(n) | |
| Malicious code in @voiceflow/eslint-config (npm) | ||
| Risiko ? / 10 | vor 490035 Stunde(n) | |
| Risiko ? / 10 | vor 490035 Stunde(n) | |
| Risiko ? / 10 | vor 490035 Stunde(n) | |
| Risiko ? / 10 | vor 490035 Stunde(n) | |
| Risiko ? / 10 | vor 490035 Stunde(n) | |
| Risiko ? / 10 | vor 490035 Stunde(n) | |
| Risiko ? / 10 | vor 490035 Stunde(n) | |
| Risiko ? / 10 | vor 490035 Stunde(n) | |
| Risiko ? / 10 | vor 490035 Stunde(n) | |
| Risiko ? / 10 | vor 490035 Stunde(n) | |
| Risiko ? / 10 | vor 490035 Stunde(n) | |
| Risiko ? / 10 | vor 490035 Stunde(n) | |
| Risiko ? / 10 | vor 490035 Stunde(n) | |
| Risiko ? / 10 | vor 490035 Stunde(n) | |
| Risiko ? / 10 | vor 490035 Stunde(n) | |
| 15.11.2025 - CodeStepByStep | 17.351 Datensätze geleaked | |
| Email addresses, Names, Usernames In November 2025, the online coding practice tool CodeStepByStep suffered a data breach that exposed 17k records. The impacted data included names, usernames and email addresses. |
||
| 13.11.2025 - Eurofiber | 10.003 Datensätze geleaked | |
| Email addresses, Names, Phone numbers In November 2025, Eurofiber France disclosed a data breach of its ticket management platform. Data containing 10k unique email addresses and a smaller number of names and phone numbers was subsequently leaked. A threat actor claiming responsibility for the breach alleges to have additional, more sensitive data including screenshots, VPN configuration files, credentials, source code, certificates, archives, and SQL backup files. |
||
| 13.11.2025 - Operation Endgame 3.0 | 2.046.030 Datensätze geleaked | |
| Email addresses, Passwords Between 10 and 13 November 2025, the latest phase of Operation Endgame was coordinated from Europol's headquarters in The Hague. The actions targeted one of the biggest infostealer Rhadamanthys, the Remote Access Trojan VenomRAT, and the botnet Elysium, all of which played a key role in international cybercrime. Authorities took down these three large cybercrime enablers and provided 2 million impacted email addresses and 7.4 million passwords to HIBP. |
||
| 11.11.2025 - International Kiteboarding Organization | 340.349 Datensätze geleaked | |
| Email addresses, Geographic locations, Names, Usernames In November 2025, the International Kiteboarding Organization suffered a data breach that exposed 340k user records. The data was subsequently listed for sale on a hacking forum and included email addresses, names, usernames and in many cases, the user's city and country. |
||
| 09.11.2025 - Beckett Collectibles | 541.132 Datensätze geleaked | |
| Email addresses, Names, Phone numbers, Physical addresses, Usernames In November 2025, Beckett Collectibles experienced a data breach accompanied by website content defacement. The stolen data was later advertised for sale on a prominent hacking forum, with portions subsequently released publicly. The publicly circulating data included more than 500k email addresses reportedly belonging to North American customers, along with a smaller subset containing names, usernames, phone numbers and physical addresses. |
||
| 24.10.2025 - MyVidster (2025) | 3.864.364 Datensätze geleaked | |
| Email addresses, Profile photos, Usernames In October 2025, the data of almost 4M MyVidster users was posted to a public hacking forum. Separate to the 2015 breach, this incident exposed usernames, email addresses and in a small number of cases, profile photos. |
||
| 06.10.2025 - TISZA Világ | 198.520 Datensätze geleaked | |
| Email addresses, Names, Phone numbers, Physical addresses, Usernames In late October 2025, data breached from the Hungarian political party TISZA was published online before being extensively redistributed. Stemming from a compromise of the TISZA Világ service earlier in the month, the breach exposed 200k records of personal data including email addresses along with names, phone numbers and physical addresses. |
||
| 01.09.2025 - Prosper | 17.605.276 Datensätze geleaked | |
| Browser user agent details, Credit status information, Dates of birth, Email addresses, Employment statuses, Government issued IDs, Income levels, IP addresses, Names, Physical addresses In September 2025, Prosper announced that it had detected unauthorised access to their systems, which resulted in the exposure of customer and applicant information. The data breach impacted 17.6M unique email addresses, along with other customer information, including US Social Security numbers. Prosper advised that they did not find any evidence of unauthorised access to customer accounts and funds, and that their customer-facing operations were uninterrupted. Further information about the incident is contained in Prosper's FAQs. |
||
| 31.08.2025 - Artists&Clients | 95.351 Datensätze geleaked | |
| Email addresses, IP addresses, Passwords, Usernames In August 2025, the "marketplace that connects artists to prospective clients" Artists&Clients, suffered a data breach and subsequent ransom demand of US$50k. The data was subsequently leaked publicly and included 95k unique email addresses alongside usernames, IP addresses and bcrypt password hashes. |
||
| 25.08.2025 - Miljödata | 870.108 Datensätze geleaked | |
| Dates of birth, Email addresses, Genders, Government issued IDs, Names, Phone numbers, Physical addresses In August 2025, the Swedish system supplier Miljödata was the victim of a ransomware attack. Following the attack, data was subsequently published on the dark web and included 870k unique email addresses across various compromised files. Data also included names, phone numbers, physical addresses, dates of birth and government-issued personal identity numbers. |
||
| 09.08.2025 - Giglio | 1.026.468 Datensätze geleaked | |
| Email addresses, Names, Phone numbers, Physical addresses In August 2025, over 1M unique email addresses appeared in a breach allegedly obtained from Italian fashion designer Giglio. The data also included names, phone numbers and physical addresses. Giglio did not respond to repeated attempts to disclose the incident. |
||
| 04.08.2025 - Bouygues Telecom | 5.685.771 Datensätze geleaked | |
| Bank account numbers, Dates of birth, Email addresses, Names, Phone numbers, Physical addresses In August 2025, the French telecommunications company Bouygues Telecom detected a cyber attack against their services. The incident resulted in a data breach that exposed almost 6.4M customer records, including 5.7M unique email addresses. The breach also exposed names, physical addresses, phone numbers, dates of birth and IBANs (International Bank Account Numbers). Bouygues Telecom advised that all affected customers had been notified about the incident. |
||
| 30.07.2025 - Pi-hole | 29.926 Datensätze geleaked | |
| Email addresses, Names In July 2025, a vulnerability in the GiveWP WordPress plugin exposed the names and email addresses of approximately 30k donors to the Pi-hole network-wide ad blocking project. Pi-hole subsequently self-submitted the list of impacted donors to HIBP. |
||
| 25.07.2025 - Hello Cake | 22.907 Datensätze geleaked | |
| Dates of birth, Email addresses, Names, Phone numbers, Physical addresses, Purchases In July 2025, the sexual healthcare product maker Hello Cake suffered a data breach. The data was subsequently posted on a public hacking forum and included 23k unique email addresses along with names, phone numbers, physical addresses, dates of birth and purchases. |
||
| 16.07.2025 - Allianz Life | 1.115.061 Datensätze geleaked | |
| Dates of birth, Email addresses, Genders, Names, Phone numbers, Physical addresses In July 2025, Allianz Life was the victim of a cyber attack which resulted in millions of records later being leaked online. Allianz attributed the attack to "a social engineering technique" which targeted data on Salesforce and resulted in the exposure of 1.1M unique email addresses, names, genders, dates of birth, phone numbers and physical addresses. |
||
| 27.06.2025 - TheSqua.re | 107.041 Datensätze geleaked | |
| Email addresses, Geographic locations, Names, Phone numbers In June 2025, 107k unique customer email addresses were allegedly obtained from TheSqua.re, the "easiest way to find your next serviced apartment". The data also included names, phone numbers and cities which were subsequently posted to a popular hacking forum. TheSqua.re did not respond to repeated attempts to disclose the incident, however multiple impacted HIBP subscribers confirmed the legitimacy and accuracy of the data. |
||
| 22.06.2025 - MaReads | 74.453 Datensätze geleaked | |
| Dates of birth, Email addresses, Phone numbers, Usernames In June 2025, MaReads, the website for readers and writers of Thai-language fiction and comics suffered a data breach that exposed 74k records. The breach included usernames, email addresses, phone numbers and dates of birth. MaReads is aware of the breach. |
||
| 20.06.2025 - Data Troll Stealer Logs | 109.532.219 Datensätze geleaked | |
| Email addresses, Passwords In June 2025, headlines erupted over a "16 billion password" breach. In reality, the dataset was a compilation of publicly accessible stealer logs, mostly repurposed from older leaks, with only a small portion of genuinely new material. HIBP received 2.7B rows containing 109M unique email addresses, which was subsequently added to the service under the name "Data Troll". The websites the stealer logs were captured against are searchable via the HIBP dashboard. |
||
| 20.06.2025 - Vietnam Airlines | 7.316.915 Datensätze geleaked | |
| Dates of birth, Email addresses, Loyalty program details, Names, Phone numbers In October 2025, data stolen from the Salesforce instances of multiple companies by a hacking group calling itself "Scattered LAPSUS$ Hunters" was publicly released. Among the affected organisations was Vietnam Airlines, which had 7.3M unique customer email addresses exposed following a breach of its Salesforce environment in June of that year. The compromised data also included names, phone numbers, dates of birth, and loyalty program membership numbers. |
||
| 09.06.2025 - Catwatchful | 61.641 Datensätze geleaked | |
| Email addresses, Passwords In June 2025, spyware maker Catwatchful suffered a data breach that exposed over 60k customer records. The breach was due to a SQL injection vulnerability that enabled email addresses and plain text passwords to be extracted from the system. |
||
| 08.06.2025 - Omnicuris | 215.298 Datensätze geleaked | |
| Email addresses, Geographic locations, Names, Phone numbers In June 2025, the Indian CME platform Omnicuris suffered a data breach that exposed approximately 200k records of healthcare professionals. The data included names, email addresses, phone numbers, geographic locations and other data attributes relating to professional expertise and training progress. Omnicuris is aware of the incident. |
||
| 24.05.2025 - ColoCrossing | 7.183 Datensätze geleaked | |
| Email addresses, Names, Passwords In May 2025, hosting provider ColoCrossing identified a data breach that impacted customers of their ColoCloud virtual server product. ColoCrossing advised the incident was isolated to their cloud/VPS platform and stemmed from a single sign-on vulnerability. 7k email addresses were exposed in the incident along with names and MD5-Crypt password hashes. |
||
| 23.05.2025 - Operation Endgame 2.0 | 15.436.844 Datensätze geleaked | |
| Email addresses, Passwords In May 2025, a coalition of law enforcement agencies took down the criminal infrastructure behind the malware used to launch ransomware attacks in a new phase of "Operation Endgame". This followed the first Operation Endgame exercise a year earlier, with the latest action resulting in 15.3M victim email addresses being provided to HIBP by law enforcement. A further 43.8M victim passwords were also provided for HIBP's Pwned Passwords service. |
||
| 06.05.2025 - Ualabee | 472.296 Datensätze geleaked | |
| Dates of birth, Email addresses, Names, Phone numbers, Profile photos In May 2025, the South American mobility services platform Ualabee had hundreds of thousands of records scraped from an interface on their platform. The data included 472k unique email addresses along with names, profile photos, dates of birth and phone numbers. |
||
| 01.05.2025 - Creams Cafe | 159.652 Datensätze geleaked | |
| Email addresses, Names, Phone numbers, Physical addresses In May 2025, 160k records of customer data was allegedly obtained from Creams Cafe, "the UK's favourite dessert parlour". The data included email and physical addresses, names and phone numbers. Creams Cafe did not respond to repeated attempts to disclose the incident, however multiple impacted HIBP subscribers confirmed the legitimacy and accuracy of the data. |
||
| 11.04.2025 - Synthient Credential Stuffing Threat Data | 1.957.476.021 Datensätze geleaked | |
| Email addresses, Passwords During 2025, the threat-intelligence firm Synthient aggregated 2 billion unique email addresses disclosed in credential-stuffing lists found across multiple malicious internet sources. Comprised of email addresses and passwords from previous data breaches, these lists are used by attackers to compromise other, unrelated accounts of victims who have reused their passwords. The data also included 1.3 billion unique passwords, which are now searchable in Pwned Passwords. Working to turn breached data into awareness, Synthient partnered with HIBP to help victims of cybercrime understand their exposure. |
||
| 11.04.2025 - Synthient Stealer Log Threat Data | 182.962.095 Datensätze geleaked | |
| Email addresses, Passwords During 2025, Synthient aggregated billions of records of "threat data" from various internet sources. The data contained 183M unique email addresses alongside the websites they were entered into and the passwords used. After normalising and deduplicating the data, 183 million unique email addresses remained, each linked to the website where the credentials were captured, and the password used. This dataset is now searchable in HIBP by email address, password, domain, and the site on which the credentials were entered. |
||
| 30.03.2025 - Samsung Germany Customer Tickets | 216.333 Datensätze geleaked | |
| Email addresses, Names, Physical addresses, Purchases, Salutations, Shipment tracking numbers, Support tickets In March 2025, data from Samsung Germany was compromised in a data breach of their logistics provider, Spectos. Allegedly due to credentials being obtained by malware running on a Spectos employee's machine, the breach included 216k unique email addresses along with names, physical addresses, items purchased from Samsung Germany and related support tickets and shipping tracking numbers. |
||
| 27.03.2025 - German Doner Kebab | 162.373 Datensätze geleaked | |
| Email addresses, Names, Phone numbers, Physical addresses In March 2025, data allegedly sourced from German Doner Kebab was published on a popular hacking forum. The data included 162k unique email addresses alongside names, phone numbers and physical addresses. German Doner Kebab subsequently sent a disclosure notice to impacted individuals. |
||
| 26.03.2025 - TehetségKapu | 54.357 Datensätze geleaked | |
| Email addresses, Names, Usernames In March 2025, almost 55k records were breached from the Hungarian education office website TehetségKapu. The data was subsequently published to a popular hacking forum and included email addresses, names and usernames. |
||
| 25.03.2025 - Troy Hunt's Mailchimp List | 16.627 Datensätze geleaked | |
| Email addresses, Geographic locations, IP addresses In March 2025, a phishing attack successfully gained access to Troy Hunt's Mailchimp account and automatically exported a list of people who had subscribed to the newsletter for his personal blog. The exported list contained 16k email addresses and other data automatically collected by Mailchimp including IP address and a derived latitude, longitude and time zone. |
||
| 24.03.2025 - ADDA | 1.829.314 Datensätze geleaked | |
| Email addresses, Names, Passwords, Phone numbers In March 2025, data allegedly breached from the ADDA housing societies service was posted to a public hacking forum. The data contained over 1.8M unique email addresses along with names, phone numbers and MD5 password hashes. |
||
| 24.02.2025 - Orange Romania | 556.557 Datensätze geleaked | |
| Email addresses, Partial credit card data, Phone numbers In February 2025, the Romanian arm of telecommunications company Orange suffered a data breach which was subsequently published to a popular hacking forum. The data included 556k email addresses (of which hundreds of thousands were in the form of [phone number]@as1.romtelecom.net), phone numbers, subscription details, partial credit card data (type, last 4 digits, expiration date and issuing bank). The breach also exposed an extensive number of internal documents. |
||
| 15.02.2025 - ALIEN TXTBASE Stealer Logs | 284.132.969 Datensätze geleaked | |
| Email addresses, Passwords In February 2025, 23 billion rows of stealer logs were obtained from a Telegram channel known as ALIEN TXTBASE. The data contained 284M unique email addresses alongside the websites they were entered into and the passwords used. This data is now searchable in HIBP by both email domain and the domain of the target website. |
||
| 14.02.2025 - Adpost | 3.339.512 Datensätze geleaked | |
| Email addresses, Names, Usernames In February 2025, data allegedly obtained from an earlier Adpost breach surfaced. The dataset contained 3.3M records including email addresses, usernames, and display names. Multiple attempts to contact Adpost regarding the incident received no response. |
||
| 14.02.2025 - Cocospy | 1.798.059 Datensätze geleaked | |
| Email addresses In February 2025, the spyware service Cocospy suffered a data breach along with sibling spyware service, Spyic. The Cocospy breach alone exposed almost 1.8M customer email addresses which were provided to HIBP, and reportedly also enabled unauthorised access to captured messages, photos, call logs, and more. |
||
| 14.02.2025 - Spyic | 875.999 Datensätze geleaked | |
| Email addresses In February 2025, the spyware service Spyic suffered a data breach along with sibling spyware service, Cocospy. The Spyic breach alone exposed almost 876k customer email addresses which were provided to HIBP, and reportedly also enabled unauthorised access to captured messages, photos, call logs, and more. |
||
| 11.02.2025 - Lexipol | 672.546 Datensätze geleaked | |
| Email addresses, Names, Passwords, Phone numbers, Usernames In February 2025, the public safety policy management systems company Lexipol suffered a data breach. Attributed to the self-proclaimed "Puppygirl Hacker Polycule", the breach exposed an extensive number of documents and user records which were subsequently published publicly. The breach included over 670k unique email addresses in the user records, along with names, phone numbers, system-generated usernames and passwords stored as either MD5 or SHA-256 hashes. |
||
| 30.01.2025 - Thermomix Recipe World Forum | 3.123.439 Datensätze geleaked | |
| Bios, Dates of birth, Email addresses, Names, Phone numbers, Physical addresses, Usernames In January 2025, the Rezeptwelt (German for "recipe world") forum for Thermomix owners suffered a data breach. The incident exposed 3.1M registered users' details including names, email and physical addresses, phone numbers, dates of birth and bios (usually cooking related). |
||
| 24.01.2025 - Doxbin Scrape | 435.784 Datensätze geleaked | |
| Email addresses In January 2025, 435k email addresses were scraped from the "doxing" service Doxbin. Posts to the service are usually intended to disclose the personal information of non-consensually third parties. |
||