Our Repository
Real-time insights into global data breaches. Explore patterns, risks, and trends to stay informed.
797
Total Breaches
11.72B
Exposed Records
5.19B
Unique Emails
836.0M
Exposed Passwords
Key Statistics
As of , the XposedOrNot data breach repository indexes 797 data breaches totalling 11,717,638,889 exposed records, including 5,193,759,555 unique email addresses and 835,955,029 exposed passwords.
The most affected industry is Entertainment with 223 breaches, followed by Information Technology (136) and Retail (109). Just 15 breaches account for 51% of all exposed records. The largest single breach, 1.4BillionRecords, exposed 1,114,303,554 records.
Key Insights
Live DataTop Contributors
15
breaches account for 51% of all records
Verified Breaches
763
95.7% of all breaches verified
Searchable
742
breaches available for lookup
Industries Affected
20
distinct sectors impacted
Yearly Breach Trend
| Year | Breaches |
|---|---|
| 2007 | 1 |
| 2008 | 2 |
| 2009 | 2 |
| 2010 | 3 |
| 2011 | 15 |
| 2012 | 14 |
| 2013 | 27 |
| 2014 | 41 |
| 2015 | 57 |
| 2016 | 77 |
| 2017 | 36 |
| 2018 | 53 |
| 2019 | 71 |
| 2020 | 79 |
| 2021 | 60 |
| 2022 | 51 |
| 2023 | 33 |
| 2024 | 54 |
| 2025 | 36 |
| 2026 | 85 |
Password Security Risk
| Risk level | Breaches |
|---|---|
| Plaintext | 84 |
| Easy to crack | 211 |
| Hard to crack | 158 |
| Unknown | 344 |
Most Exposed Data Types
| Data type | Share of breaches |
|---|---|
| Email Addresses | 100% |
| Passwords | 65% |
| Names | 53% |
| Usernames | 50% |
| Phone Numbers | 36% |
| IP Addresses | 35% |
| Physical Addresses | 28% |
| Dates of Birth | 25% |
Breach Size Distribution
Mega (100M+)
24
61.7% of records
Large (10M-100M)
110
28.6% of records
Medium (1M-10M)
281
8.5% of records
Small (100K-1M)
290
1.1% of records
Tiny (<100K)
92
0.04% of records
Identity Theft Risk Combinations
Full Identity Exposure
Name + DOB + Address + Phone combined
62
Breaches
1.14B
Records
Email + Government ID
High-risk for account takeover and fraud
26
Breaches
173.7M
Records
Email + Financial Data
Credit cards, SSN, account info exposed
9
Breaches
47.7M
Records
Breaches by Industry
Top 10 Largest Breaches
| Logo | Breach | Description | Records |
|---|---|---|---|
 | 1.4 Billion Records | 4iQ, a cybersecurity company, uncovered a massive credential collection in 2017 containing more than 1.4B unique username and password combinations along with email addresses and IP addresses. The dataset was widely circulated on dark web marketplaces and represented data aggregated from multiple prior breaches rather than a single incident. | 1.11B |
| Collection #1 | Collection #1 is the name of a collection of email addresses and passwords that appeared on the dark web around January 2019. The database contains over 790 million unique email addresses, resulting in more than 2.7 billion email/password sets. | 790.8M |
 | Verifications | Verifications.io, a comprehensive email verification service, suffered a severe data breach in 2019 that compromised a vast array of personal user data. The exposed data included email addresses, phone numbers, dates of birth, and other personal details, which presented a considerable privacy and security risk to the affected users. | 762.6M |
| Exploit.in | Exploit.IN was a hacking forum and marketplace that was hacked in 2016. The hacker gained access to the site's database, which contained over 590 million user accounts with email addresses, usernames, IP addresses, and hashed passwords. The database was subsequently made available for free download on a popular hacking forum. | 592.9M |
| Anti Public Combo | The Anti Public Combo List, an aggregate collection consisting of data from various breaches, was made public on 2016.This compilation predominantly contained email addresses and passwords from multiple sources, thereby amplifying the potential risks to affected individuals. | 457.4M |
| Alien Stealer Logs | ALIEN TXTBASE, a stealer log collection, was exposed in February 2025 when 23 billion rows of logs were obtained from a Telegram channel, revealing 299M unique email addresses along with the websites they were entered into and the passwords used. | 299.6M |
| Alleged-SOCRadar | SOCRadar faced allegations from a threat actor, identified as USDoD, claiming a leak of over 330 million email addresses. However, SOCRadar's investigation revealed no breach of its internal systems. The actor had legitimately acquired access to SOCRadar's platform and utilized its capabilities to gather publicly available email addresses from Telegram channels. SOCRadar confirmed that no customer data or sensitive internal information was compromised. | 283.0M |
 | Wattpad | Wattpad, a self-publishing platform that claims to be “the world’s most-loved social storytelling platform,” suffered a data breach exposing all of its users. The leaked database included more than 270 million records with more than 268 million unique email address and password combinations. Exposed data includes email address, date of birth, gender if provided, IP address upon sign up, if signed up before 2017, display name, account name, and salted and cryptographically hashed passwords. | 268.1M |
 | Deezer | Deezer, a music streaming service, suffered a data breach that was made public in November 2022 but originally occurred in 2019. The breach exposed the personal details of 240 million users, including first and last names, dates of birth, email addresses, gender, location data, join date, user ID, session IP addresses, and language. | 244.0M |
 | NetEase | NetEase, a Chinese internet technology company, suffered a data breach in 2015, where personal information of around 200 million users was exposed, including email addresses, usernames, and hashed passwords. | 232.9M |
Recent Breaches
| Logo | Breach | Description | Records |
|---|---|---|---|
 | Neogen | Neogen, a food and animal safety company, was allegedly breached by the ShinyHunters group in August 2026, with data later published online exposing 445k unique email addresses from corporate mailing lists, employee records, and other business contacts. | 445.9K |
 | Gîtes de France | Gîtes de France, a French holiday rental network, was breached in May 2026, affecting several departmental branches and exposing 118k unique email addresses along with customer names, phone numbers, postal addresses, and booking details. | 117.7K |
 | Assurance Retraite | Assurance Retraite, France's national pension fund, suffered a data breach through a compromised partner in September 2024, affecting approximately 370k beneficiaries and exposing 70k unique email addresses along with names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers (NIR), and contact details of relatives or nominated contacts. | 70.7K |
 | Zoosk (2020) | Zoosk, an online dating platform, was breached in January 2020, exposing 37M unique email addresses along with genders, sexual orientations, dates of birth, physical attributes, religions, ethnicities, and political views. MD5 password hashes were allegedly included in the breach, although circulating copies contained no password hash values. | 37.4M |
 | Crunchbase | Crunchbase, a private company intelligence platform, was targeted by the ShinyHunters group in January 2026, with data later published online exposing 560k unique email addresses along with names, physical addresses, phone numbers, job titles, employers, and LinkedIn profiles, primarily relating to leads and business contacts. | 560.4K |
 | SuperVPN and GeckoVPN | SuperVPN, GeckoVPN, and FlashVPN, three free VPN services, were reportedly breached in February 2021, exposing over 20M records containing email addresses, login locations, timestamps, and device information including makes, models, IMSI numbers, and serial numbers. | 20.4M |
 | Double Counter | Double Counter, a Discord server protection service, was breached in October 2026 through a vulnerability in the Metabase analytics tool, exposing 294k unique email addresses along with Discord usernames. | 294.7K |
 | Angel One | Angel One, an Indian stock brokerage firm, was breached in April 2023, with data later leaked online exposing 7.9M user records including 6.8M unique email addresses along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs), and portfolio holdings. | 6.8M |
 | LimeLeads | LimeLeads, a B2B marketing leads database service, was compromised in 2019 through an unsecured Elasticsearch server, exposing 18M unique email addresses along with phone numbers, employer names, job titles, and geographic locations including states, cities, and postcodes. | 18.1M |
 | Medela | Medela, a Swiss medical device company, was allegedly breached by the ShinyHunters group in September 2026, with data later published online exposing 424k unique email addresses along with names, physical addresses, phone numbers, and support ticket information relating predominantly to healthcare professionals, staff, and leads. | 423.9K |