June 2026 Stealer Logs
June 15, 2026
•[ malware, hack ]
In June 2026, a collection of accumulated stealer logs from various sources was added to HIBP. The corpus comprised 56M unique email addresses across hundreds of millions of stealer log records. The data also contained 124M unique passwords, which have been added to Pwned Passwords and are now searchable. Individuals can view any records captured against their email address in the stealer logs section of their dashboard. Organisations can see logs affecting their domain via the stealer logs API.
Former President Donald Trump’s campaign
August 1, 2024
•[ hack, cyberattack, foreign interference ]
The FBI is investigating the alleged hack of former President Donald Trumps campaign, days after the campaign blamed Iran for a breach.
Russian Ministry of Construction, Housing and Utilities (minstroyrf.gov.ru)
June 4, 2022
•[ hack, defacement, ransom ]
The Russian Ministry of Construction, Housing and Utilities (minstroyrf.gov.ru) is hacked. When searched on the internet, the sites address leads to a sign in the Ukrainian language that read- Glory to Ukraine.'' The attackers also demanded ransom to prevent the leaking of personal data of the site users.
Knuddles.de
November 23, 2018
•[ hack, data leak, social network ]
Following a hack that resulted in leaking about 808,000 email addresses and over 1.8 million usernames and passwords, a social network website in Germany received a fine of EUR 20,000 from the Baden-W rttemberg Data Protection Authority.
Protei
November 8, 2025
•[ data leak, hack, website defacement ]
Surveillance-technology and telecom systems provider Protei, founded in Russia and now headquartered in Jordan, was hacked by an unidentified actor who defaced its public website around November 8, 2025 and stole the contents of its web server, including about 182 GB of historical emails and files related to its deep packet inspection and lawful intercept products used by telecoms across dozens of countries.
Kansas City Police Department
November 5, 2025
•[ data leak, hack, law enforcement ]
Reporting by KCUR, WIRED, and DataBreaches.net describes a major hack of the Kansas City, Kansas Police Department whose internal records were exfiltrated in 2024 and later published by transparency collective Distributed Denial of Secrets. The leaked cache, reportedly more than one terabyte in size, includes a secret Veracity Disclosure or Giglio List that identifies officers whose documented misconduct could undermine their testimony, along with supporting case files and internal correspondence. Police officials confirmed that the department experienced a cyber incident reported to federal agencies but criticized publication of the names as relying on stolen, unverified data and potentially harming officers reputations.
TISZA Világ
October 6, 2025
•[ leak, hack, government ]
In late October 2025, data breached from the Hungarian political party TISZA was published online before being extensively redistributed. Stemming from a compromise of the TISZA Vilg service earlier in the month, the breach exposed 200k records of personal data including email addresses along with names, phone numbers and physical addresses.
Synthient Credential Stuffing Threat Data
April 11, 2025
•[ hack, brute-force, technology ]
During 2025, the threat-intelligence firm Synthient aggregated 2 billion unique email addresses disclosed in credential-stuffing lists found across multiple malicious internet sources. Comprised of email addresses and passwords from previous data breaches, these lists are used by attackers to compromise other, unrelated accounts of victims who have reused their passwords. The data also included 1.3 billion unique passwords, which are now searchable in Pwned Passwords.
Synthient Stealer Log Threat Data
April 11, 2025
•[ hack, malware, technology ]
During 2025, Synthient aggregated billions of records of "threat data" from various internet sources. The data contained 183M unique email addresses alongside the websites they were entered into and the passwords used. After normalising and deduplicating the data, 183 million unique email addresses remained, each linked to the website where the credentials were captured, and the password used. This dataset is now searchable in HIBP by email address, password, domain, and the site on which the credentials were entered.
Prosper
September 1, 2025
•[ hack, finance ]
In September 2025, Prosper announced that it had detected unauthorised access to their systems, which resulted in the exposure of customer and applicant information. The data breach impacted 17.6M unique email addresses, along with other customer information, including US Social Security numbers. Prosper advised that they did not find any evidence of unauthorised access to customer accounts and funds, and that their customer-facing operations were uninterrupted. Further information about the incident is contained in Prosper's FAQs.
Vietnam Airlines
June 20, 2025
•[ hack, leak, technology ]
In October 2025, data stolen from the Salesforce instances of multiple companies by a hacking group calling itself "Scattered LAPSUS$ Hunters" was publicly released. Among the affected organisations was Vietnam Airlines, which had 7.5M unique customer email addresses exposed following a breach of its Salesforce environment in June of that year. The compromised data also included names, phone numbers, dates of birth, and loyalty program membership numbers.
Indigo Publications (Glitz Paris, La Lettre, Africa Intelligence, Intelligence Online)
September 2, 2025
•[ hack, ddos, technology ]
Indigo Publications reported a massive DDoS campaign in early September 2025 targeting its web infrastructure, rendering Glitz Paris and other affiliated media outlets intermittently inaccessible. Motive unconfirmed but suspected retaliation for investigative reporting.
Multiple devices at undisclosed telecommunications firm(s)
May 1, 2025
•[ hack, social, malware ]
UNC1549 (Subtle Snail) compromised multiple devices at an undisclosed telecommunications firm in United States of America using LinkedIn job-lures and the MINIBIKE backdoor; Azure-hosted C2 infrastructure was observed. No confirmed data exfiltration volumes or operational disruption reported.
Multiple devices at undisclosed telecommunications firm(s)
May 1, 2025
•[ social, hack, malware ]
UNC1549 (Subtle Snail) compromised multiple devices at an undisclosed telecommunications firm in United Kingdom using LinkedIn job-lures and the MINIBIKE backdoor; Azure-hosted C2 infrastructure was observed. No confirmed data exfiltration volumes or operational disruption reported.
Multiple devices at undisclosed telecommunications firm(s)
May 1, 2025
•[ social, hack, malware ]
UNC1549 (Subtle Snail) compromised multiple devices at an undisclosed telecommunications firm in United Arab Emirates using LinkedIn job-lures and the MINIBIKE backdoor; Azure-hosted C2 infrastructure was observed. No confirmed data exfiltration volumes or operational disruption reported.
Multiple devices at undisclosed telecommunications firm(s)
May 1, 2025
•[ social, hack, phishing ]
UNC1549 (Subtle Snail) compromised multiple devices at an undisclosed telecommunications firm in Canada using LinkedIn job-lures and the MINIBIKE backdoor; Azure-hosted C2 infrastructure was observed. No confirmed data exfiltration volumes or operational disruption reported.
Federal Emergency Management Agency (FEMA) and U.S. Customs and Border Protection (CBP)
July 1, 2025
•[ hack, government ]
Attackers gained unauthorized access to FEMA Region 6s Citrix-based virtual desktop infrastructure beginning July 2025, exfiltrating sensitive employee data from both FEMA and CBP systems. The compromise originated from stolen credentials and enabled lateral movement between federal systems before detection.
Teleradio-Moldova (Public TV and Radio)
September 23, 2025
•[ hack, ddos, technology ]
On September 23 2025, Moldovas public television and radio websites were targeted by coordinated denial-of-service attacks, briefly disrupting online access. CERT-GOV-MD linked the activity to pro-Russian hacktivists amid regional political tensions. Systems were restored the same day with no data exfiltration reported.
Union Home Mortgage Corp.
June 25, 2025
•[ hack, finance ]
Union Home Mortgage Corp. experienced unauthorized access to internal servers, exposing personal and identification data of roughly 24,000 customers. No encryption or ransomware activity was reported.
Sturgis Hospital
June 12, 2025
•[ hack, healthcare ]
Sturgis Hospital confirmed a second unauthorized network access event discovered in June 2025 while investigating an earlier breach. The incident involved potential access to protected health information. No ransomware or disruption to hospital operations was reported.
