Breach Intelligence

2,850

Total breached databases

Intelimost 2019

In March 2019, a spam operation known as "Intelimost" sent millions of emails appearing to come from people the recipients knew. Security researcher Bob Diachenko found over 3 million unique email addresses in an exposed Elasticsearch database, alongside plain text passwords used to access the victim's mailbox and customise the spam.
  • Data: Email Addresses Passwords
  • Imported:
  • Passwords: Plaintext
VBForums 2016

VBForums 2016

In July 2016, the forum for "Visual Basic and VB .NET Discussions and More" known as VBForums suffered a data breach that impacted 194k members. The breach included Usernames, Email addresses, Dates of birth, IP Addresses and Passwords stored as vBulletin hashes.
  • Data: Birthdates Email Addresses IP Addresses Passwords Usernames
  • Imported:
  • Passwords: vBulletin
  • Cracked: 0%

Ashford 2024

On September 11, 2024, Ashford.com, an online retailer specializing in luxury watches and jewelry, experienced a data breach affecting approximately 628,290 records. Among the compromised data were names, email addresses, phone numbers, geographic locations, physical addresses, birthdates, genders, company information, tax IDs, government IDs, and credit card information.
  • Date: Sep 11, 2024
  • Domain: ashford.com
  • Category: E-commerce & Retail
  • Records Announced: 628,290
  • Data: Email Addresses Names Phone Numbers Physical Locations Geographic Locations Credit Card Information Government IDs Genders Tax IDs Company Information Birthdates
  • Imported:
  • Passwords: No
Stadgenoot 2021

Stadgenoot 2021

In February 2021, the Amsterdam based housing corporation Stadgenoot suffered a data breach that impacted 33.4k users. The breach led to the exposure of data including Email addresses, Full names, Genders, Physical addresses, Phone numbers, Dates of birth, Yearly incomes and Passwords stored in an Encrypted format.
  • Data: Birthdates Email Addresses Financial Information Genders Names Passwords Phone Numbers Physical Locations
  • Imported:
  • Number of lines: 66,356
  • Size: 9.29 MB
  • Passwords: Unknown

Digimon 2016

In September 2016, over 16GB of logs from a service believed to be digimon.co.in were reportedly obtained, likely from an unprotected MongoDB instance. The service ceased operations shortly after, and little information remains about its exact purpose. Based on enquiries made via Twitter, it appeared to function as a mail service, possibly using PowerMTA, and may have been involved in delivering spam. The exposed logs included details on 7.7 million unique email recipients with names and addresses, mail server IP addresses, email subjects, and tracking information such as mail opens and clicks.
  • Data: Email Addresses IP Addresses Messages Names
  • Imported:
  • Number of lines: 579,212,392
  • Size: 31.98 GB
  • Passwords: No
Mailup.com 2018

Mailup.com 2018

The Mailup.com 2018 breach has been documented in our records, but additional information is not yet available. When the breach is imported, you will be able to search against it. For now, you can check if your data appears in other breaches.

  • Data: The data involved in the Mailup.com 2018 security incident has not been specified. We are monitoring for reliable updates and will publish them here.
  • Imported:
  • Number of lines: 633,492
  • Size: 610.14 MB
  • Passwords: ?
Tokensoft 2022

Tokensoft 2022

In November 2022, the crypto platform Tokensoft purposefully doxed 4.4k users of their platform due to them being "Bad actors". The leak led to the exposure of data including Email addresses, IP Addresses, Crypto addresses, Full names, Locations and Usernames.
  • Data: Cryptocurrency Information Email Addresses Geographic Locations IP Addresses Names Usernames
  • Imported:
  • Passwords: No

Frequently Asked Questions

A data breach is unauthorized access to data (often involving account takeover, malware, or misconfigured infrastructure). A data leak is exposure of data due to mistakes like public cloud storage, open databases, or accidental publishing. A database dump is a packaged dataset that may come from a breach, leak, scraping, or aggregation.

Change passwords for any affected accounts immediately, prioritizing email, banking, and any account that shares the same password. Enable multi-factor authentication wherever possible. Monitor your accounts for suspicious activity and consider placing a fraud alert or credit freeze if financial data was exposed.

Start with containment and verification: confirm what data was exposed, identify the entry point, rotate credentials (especially SSO, VPN, email), and enforce MFA. Then investigate affected systems, notify stakeholders as required, and harden controls to prevent recurrence. A structured incident response plan helps keep the work measurable and compliant.

Dark web monitoring helps you spot exposure signals early — before stolen data is widely reused for account takeover or targeted attacks. Monitoring complements vulnerability management by revealing when attackers already have leverage. Pair it with continuous attack surface monitoring and strong Asset Discovery to reduce blind spots.

Not always. Some datasets are old, incomplete, or derived from third parties. However, any exposure increases risk because credentials and personal data can be reused indefinitely. Treat it as a priority signal: rotate credentials, enforce MFA, review suspicious logins, and audit the systems that could have produced the data.

SynScan helps you connect the dots between attack surface exposure, vulnerabilities, and breach signals so you can prioritize remediation and reduce the chance of repeat incidents.