-
Biohack.me
December 2, 2016
In December 2016, the forum for the biohacking website Biohack.me suffered a data breach that exposed 3.4k accounts. The data included usernames, email addresses and hashed passwords along with the private messages of forum members. The data was self-submitted to HIBP by the Biohack.me operators.
-
Bestialitysextaboo
March 19, 2018
In March 2018, the animal bestiality website known as Bestialitysextaboo was hacked. A collection of various sites running on the same service were also compromised and details of the hack (including links to the data) were posted on a popular forum. In all, more than 3.2k unique email addresses were included alongside usernames, IP addresses, dates of birth, genders and bcrypt hashes of passwords.
-
Z-lib
June 20, 2024
•
[ leak, misconfiguration, technology ]
In June 2024, almost 10M user records from Z-lib were discovered exposed online. Now defunct, Z-lib was a malicious clone of Z-Library, a well-known shadow online platform for pirating books and academic papers. The exposed data included usernames, email addresses, countries of residence, Bitcoin and Monero cryptocurrency wallet addresses, purchases and bcrypt password hashes.
-
Vastaamo
March 31, 2019
•
[ ransomware, malware, healthcare ]
In October 2020, the Finnish psychotherapy service Vastaamo was the subject of a ransomware attack targeting first the company itself, followed by their patients directly. The original security incident dates back to a period between late 2018 and early 2019 and exposed data including 30k unique email addresses, names, social security numbers and notes on individuals' psychotherapy sessions. This breach has been flagged as "sensitive" and is only searchable by owners of the email addresses and domains exposed in the incident.
-
Onliner Spambot
August 28, 2017
In August 2017, a spambot by the name of Onliner Spambot was identified by security researcher Benkow mouq. The malicious software contained a server-based component located on an IP address in the Netherlands which exposed a large number of files containing personal information. In total, there were 711 million unique email addresses, many of which were also accompanied by corresponding passwords. A full write-up on what data was found is in the blog post titled Inside the Massive 711 Million Record Onliner Spambot Dump.
-
CoinMarketCap
October 12, 2021
During October 2021, 3.1 million email addresses with accounts on the cryptocurrency market capitalisation website CoinMarketCap were discovered being traded on hacking forums. Whilst the email addresses were found to correlate with CoinMarketCap accounts, it's unclear precisely how they were obtained. CoinMarketCap has provided the following statement on the data: "CoinMarketCap has become aware that batches of data have shown up online purporting to be a list of user accounts. While the data lists we have seen are only email addresses (no passwords), we have found a correlation with our subscriber base. We have not found any evidence of a data leak from our own servers we are actively investigating this issue and will update our subscribers as soon as we have any new information."
-
Baby Names
October 24, 2008
•
[ leak ]
In approximately 2008, the site to help parents name their children known as Baby Names suffered a data breach. The incident exposed 846k email addresses and passwords stored as salted MD5 hashes. When contacted in October 2018, Baby Names advised that "the breach happened at least ten years ago" and that members were notified at the time.
-
Adult FriendFinder (2016)
October 16, 2016
In October 2016, the adult entertainment company Friend Finder Networks suffered a massive data breach. The incident impacted multiple separate online assets owned by the company, the largest of which was the Adult FriendFinder website alleged to be "the world's largest sex & swinger community". Exposed data included usernames, passwords stored as SHA-1 hashes and 170 million unique email addresses. This incident is separate to the 2015 data breach Adult FriendFinder also suffered. The data was provided to HIBP by dehashed.com.
-
Team Software
July 26, 2024
•
[ leak, technology ]
Business software maker Team Software (WorkWave) revealed this week that a recent data breach impacts nearly 100,000 individuals.
-
Form I-9 Compliance
April 12, 2024
•
[ leak ]
Employee eligibility verification solutions provider Form I-9 Compliance suffers a data breach and its impact is far bigger than initially believed, reaching 190,000 people.
-
Organizations in Israel
October 31, 2024
•
[ espionage, malware, technology ]
Researchers at Check Point reveal that the threat actor dubber WIRTE, affiliated with Hamas has expanded its malicious cyber operations beyond espionage to carry out disruptive attacks with the SameCoin malware that exclusively target Israeli entities.
-
Delta
May 15, 2024
Delta confirms a data breach involving employee information after data allegedly stolen during the May 2023 MOVEit attacks is leaked on a forum.
-
Hyp
November 10, 2024
•
[ financial, ddos, finance ]
Devices used across Israel to read credit cards malfunction after a suspected DDoS targets the payment gateway company Hyps CreditGuard product.
-
Guardian Healthcare
November 8, 2024
•
[ ransomware, malware, healthcare ]
Guardian Healthcare is the victim of a Stormous ransomware attack. The threat actors leaked 3 GB of files, many of which contain protected health information (PHI) of patients.
-
Forth
May 21, 2024
•
[ leak, finance ]
Debt relief solutions provider Forth (Set Forth) notifies 1.5 million individuals that their personal information was compromised in a May 2024 data breach.
-
Government Websites and Private Companies in South Korea
November 8, 2024
•
[ hack, ddos, government ]
Pro-Russian hacktivists target South Korea with DDoS attacks as North Korea joins the Ukraine war.
-
Houston Housing Authority
September 22, 2024
•
[ ransomware, malware, government ]
The Houston Housing Authority falls victim of a ransomware attack.
-
Microlise
November 6, 2024
•
[ hack, government ]
A cyberattack on Microlise leaves British prison vans without tracking systems or panic alarms.
-
Singapore Telecommunications
June 15, 2024
•
[ espionage, technology ]
The Chinese threat actors from Volt Typhoon reportedly breached Singapore Telecommunications (SingTel) over the summer as part of their ongoing attacks against critical infrastructure operators.
-
MIT’s Technology Review
November 4, 2024
•
[ leak, misconfiguration, technology ]
The threat actor known as Intel Broker claims to have stolen the personal data of 290,762 individuals from MITs Technology Review website via a third-party contractor.
