Rivian IPO: Shares pop following blockbuster debut

In approximately mid-2015, the forum for CheapAssGamer.com suffered a data breach. The database from the IP.Board based forum contained 445k accounts including usernames, email and IP addresses and salted MD5 password hashes. In March 2020, the photo print service Chatbooks best free forex trading indicators for metatrader 4 suffered a data breach which was subsequently put up for sale on a dark web marketplace. The breach contained 15 million user records with 2.5 million unique email addresses alongside names, phone numbers, social media profiles and salted SHA-512 password hashes.

On analysis, it’s highly likely the data stems from the same incident with 142M records having been discovered for sale on a dark web marketplace in mid-2020. The exposed data included email and physical addresses, names, phone numbers and dates of birth. In 2013 , the Chinese e-commerce service JD suffered a data breach that exposed 13GB of data containing 77 million unique email addresses. The data also included usernames, phone numbers and passwords stored as SHA-1 hashes.

• In approximately mid-2016, the Italian-based service for creating forums known as ForumCommunity suffered a data breach.
• The breach was identified among a collection of other large incidents and exposed almost 20M unique email addresses, names, usernames, bios and password hashes.
• In November 2021, the online trading platform Robinhood suffered a data breach after a customer service representative was socially engineered.

In March 2021, news broke of a massive data breach impacting millions of Adecco customers in South America which was subsequently sold on a popular hacking forum. The breach exposed over 4M unique email addresses as well as genders, dates of birth, marital statuses, phone numbers and passwords stored as bcrypt hashes. In January 2020, the online dating service Zoosk suffered a data breach which was subsequently shared extensively across online hacking communities. The breach also allegedly exposed MD5 password hashes, although the data circulating in hacking circles had this field nulled out.

Key Data

The data was provided to HIBP by a source who asked for it to be attributed to « Kuroi’sh or Gabriel Kimiaie-Asadi Bildstein ». In December 2016, the forum for the public blockchain-based distributed computing platform Ethereum suffered a data breach. The database contained over 16k unique email addresses along with IP addresses, private forum messages and bcrypt hashed passwords. Ethereum elected to self-submit the data to HIBP, providing the service with a list of email addresses impacted by the incident.

• The IP.Board based forum stored passwords as weak SHA1 salted hashes and the breached data also included usernames, email and IP addresses.
• Whilst there has been no public attribution of the breach, the leaked data included over 227k accounts and nearly 10k private messages between users of the forum.
• In June 2017, news broke that CashCrate had suffered a data breach exposing 6.8 million records.
• In June 2020, the online fragrance service Scentbird suffered a data breach that exposed the personal information of over 5.8 million customers.
• The leaked data included usernames, email addresses and passwords stored as straight MD5 hashes.
• Linux Forums did not respond to multiple attempts to contact them about the breach.

The data set provided to HIBP had almost 2.5M unique email addresses (all of which were from Yahoo!) alongside names, genders and physical addresses. Some time prior to May 2016, the forum known as « Rosebutt Board » was hacked and 107k accounts were exposed. In March 2014, the booter service Quantum Booter suffered a breach which lead to the disclosure of their internal database.

Breached websites that have been loaded into Have I Been Pwned

In May 2019, the online food ordering service EatStreet suffered a data breach affecting 6.4 million customers. An extensive amount of personal data was obtained including names, phone numbers, addresses, partial credit card data and passwords stored as bcrypt hashes. In mid-2019, the Indian interactive online tutoring platform Vedantu suffered a data breach which exposed the personal data of 687k users. The JSON formatted database dump exposed extensive personal information including email and IP address, names, phone numbers, genders and passwords stored as bcrypt hashes. When contacted about the incident, Vedantu advised that they were aware of the breach and were in the process of informing their customers. In November 2015, the forum software maker vBulletin suffered a serious data breach.

In October 2020, the Finnish psychotherapy service Vastaamo was the subject of a ransomware attack targeting first the company itself, followed by their patients directly. This breach has been flagged as « sensitive » and is only searchable by owners of the email addresses and domains exposed in the incident. In December 2020, the Oklahoma state Tourism and Recreation Department suffered a data breach. The incident exposed 637k email addresses across a variety of tables including age ranges against brochure orders and dates of birth against contest entries.

The data included names, IP addresses, browser user agent strings and passwords stored as bcrypt hashes. In August 2016, the pocket PC fan site forum PPCGeeks suffered a data breach that exposed over 490k records. The breach of the vBulletin forum exposed email and IP addresses, usernames, dates of birth and passwords stored as salted MD5 hashes. In May 2020, the hacking forum Nulled.ch was breached and the data published to a rival hacking forum. Over 43k records were compromised and included IP and email addresses, usernames and passwords stored as salted MD5 hashes alongside the private message history of the website’s admin. The data was provided to HIBP by a source who requested it be attributed to « Split10 ».

ThisHabbo Forum

Whilst the actual date of the exploit is not clear, the breached data includes usernames, email addresses, IP addresses and salted hashes of passwords. A further 584k records were added from a more comprehensive breach file provided in October 2016. In November 2017, the open television database known as TheTVDB.com suffered a data breach.

In April 2018, the online arts database Artsy suffered a data breach which consequently appeared for sale on a dark web marketplace. Over 1M accounts were impacted and included IP and email addresses, names and passwords stored as salted SHA-512 hashes. A total of 10.6 million email addresses were impacted by the breach which also exposed usernames, IP addresses, birthdays of administrator accounts and passwords stored as salted SHA-1 hashes.

In mid-2015, the Dutch Minecraft site ServerPact was hacked and 73k accounts were exposed. Along with birth dates, email and IP addresses, the site also exposed SHA1 password hashes with the username as the salt. In approximately October 2016, the Spanish Pokémon site Pokémon Negro suffered a data breach. The attack resulted in the disclosure of 830k accounts including email and IP addresses along with plain text passwords.

844 Separate Data Breaches

In January 2021, data from a number of breached services including Tuned Global were released to a public hacking forum. The breach appears to date back to 2016 and includes 985k records containing email addresses, names, a small number of physical addresses and phone numbers and passwords stored in plain text. In December 2015, the instant messaging application Trillian suffered a data breach. The breach became known in July 2016 and exposed various personal data attributes including names, email addresses and passwords stored as salted MD5 hashes.

The breached data was subsequently posted to Twitter by the alleged perpetrator of the breach. In January 2022, a vulnerability in Twitter’s platform allowed an attacker to build a database of the email addresses and phone numbers of millions of users of the social platform. In a disclosure notice later shared in August 2022, Twitter advised that the vulnerability was related to a bug introduced in June 2021 and that they are directly notifying impacted customers. The impacted data included either email address or phone number alongside other public information including the username, display name, bio, location and profile photo. The data included 6.7M unique email addresses across both active and suspended accounts, the latter appearing in a separate list of 1.4M addresses.

In October 2011, the Android Forums website was hacked and 745k user accounts were subsequently leaked publicly. The compromised data included email addresses, user birth dates and passwords stored as a salted MD5 hash. In July 2018, the Indian self-drive volatility from the investor’s point of view car rental company Zoomcar suffered a data breach which was subsequently sold on a dark web marketplace in 2020. The breach exposed over 3.5M records including names, email and IP addresses, phone numbers and passwords stored as bcrypt hashes.

Bitcoin Security Forum Gmail Dump

The exposed records included names, both work and personal email addresses, job titles and links to the individuals’ LinkedIn profiles. In July 2012, Yahoo! had their online publishing service « Voices » compromised via a SQL injection attack. The breach resulted in the disclosure of nearly half a million usernames and passwords stored in plain text. The breach showed that of the compromised accounts, a staggering 59% of people who also had accounts in the Sony breach reused their passwords across both services. In September 2019, the Halloween costume store The Halloween Spot suffered a data breach.

Veracyte: Data Suggests Cancer Risk Classification Using Clinical Factors Alone May Be Suboptimal

The data included IP addresses, email addresses and passwords stored as weak MD5 hashes. In August 2018, the spyware company SpyFone left terabytes of data publicly exposed. python developer job description The data belonged the thousands of SpyFone customers and included 44k unique email addresses, many likely belonging to people the targeted phones had contact with.