Breach Intelligence

6,873

Total breached databases

In 2011, the online western-lifestyle store Cowboy Living (cowboyliving.com) allegedly had its e-commerce order database exposed, which was later shared on a hacking forum. It has been reported that the data covered roughly 9,000 customers across about 13,000 orders. The exposed records allegedly included customer full names, email addresses, billing/shipping addresses, order dates, and order/transaction details.
  • Date: Jul 11, 2011
  • Domain: cowboyliving.com
  • Country: United States
  • Category: E-commerce & Retail
  • Data: Email Addresses Names Order Information Site Activity
  • Records: 13,424
  • Lines: 13,488
  • Size: 2.54 MB
  • Passwords: No
In September 2025, Magnus Marketing, a marketing and business consulting group operating in the Pittsburgh, Pennsylvania area (ineedmagnus.com), allegedly suffered a data breach of its business contact database. Reports suggest the database, attributed to the actor N1KA, exposed approximately 600 records. The data allegedly included full names, email addresses, phone numbers, job titles and departments, physical addresses, and associated company information such as company names, addresses, phone numbers, websites, revenue, and industry. The exposed data did not include passwords.
  • Date: Sep 2025
  • Domain: ineedmagnus.com
  • Threat Actor: N1KA
  • Country: United States
  • Category: Professional & Corporate
  • Data: Email Addresses Names Phone Numbers Physical Locations Geographic Locations Site Activity Job Information Company Information
  • Records: 590
  • Lines: 591
  • Size: 264.01 KB
  • Passwords: No
Sometime before July 2024, the XenForo-based online forum desres.us allegedly suffered a data breach. It has been reported that the exposed data included approximately 3,800 records containing email addresses, usernames, genders and time zones. No passwords were included.
  • Date: 2024
  • Domain: desres.us
  • Country: United States
  • Category: Forums & Communities
  • Data: Email Addresses Geographic Locations Usernames Genders Time Zones
  • Records: 3,810
  • Lines: 3,811
  • Size: 285.28 KB
  • Passwords: No
In July 2026, Ingram Content Group (ingramcontent.com), a major US book and content distributor, allegedly suffered a data breach attributed to the ShinyHunters group. Reports suggest exported Salesforce CRM data (contacts, leads, accounts, support cases) and Microsoft Entra (Azure AD) directory data were exposed, later published on a hacking forum. The leak allegedly included names, email addresses, phone numbers, mailing addresses, usernames, and associated company/account information for roughly 70,000 individuals.
  • Data: Email Addresses Names Phone Numbers Geographic Locations Usernames Company Information Birthdates
  • Records: 179,522
  • Lines: 1,043,822
  • Size: 145.56 MB
  • Passwords: No
Sometime before February 2023, R20 Digital (r20digital.com), a US digital-marketing and CRM platform serving med-spa, aesthetics, and consumer-financing clients, allegedly suffered a data breach. Reports suggest a database was subsequently circulated on a hacking forum. It has been reported that approximately 850,000 individuals were affected, with exposed data including names, email addresses, phone numbers, postal addresses, dates of birth, IP addresses, company details, and — for financing applicants — Social Security numbers and driver's license numbers; a small number of staff passwords were stored as bcrypt hashes.
  • Date: Feb 2023
  • Domain: r20digital.com
  • Country: United States
  • Category: Technology
  • Data: Email Addresses Passwords Names Phone Numbers Geographic Locations Government IDs Social Security Numbers IP Addresses Company Information Birthdates Driving License Numbers
  • Records: 3,816,562
  • Lines: 16,103,462
  • Size: 4.4 GB
  • Passwords: BCrypt
  • Cracked: 0%
In September 2024, nnahra.org, the website of the National Native American Human Resources Association (NNAHRA), a United States non-profit organization, allegedly suffered a data breach. Reports suggest that a partial member database of approximately 160 members was exposed, including usernames, email addresses, plaintext passwords, and first and last names.
  • Date: Sep 2024
  • Domain: nnahra.org
  • Threat Actor: Spk
  • Country: United States
  • Category: Non-Profit & Charities
  • Data: Email Addresses Passwords Names Usernames
  • Records: 162
  • Lines: 59
  • Size: 12.58 KB
  • Passwords: Plaintext
In December 2024, the US-based information security training and certification provider Certified Information Security (operated by Certified Tech Trainers) allegedly suffered a data breach. Reports suggest the incident was carried out by a ransomware group and that the site's database was subsequently published on a hacking forum. Approximately 72,000 individuals were reportedly affected, with the exposed data including email addresses, usernames, names, phone numbers, physical and geographic locations, IP addresses, company information, site activity, payment-related information, and passwords stored as bcrypt hashes.
  • Data: Email Addresses Passwords Names Phone Numbers Physical Locations Geographic Locations Usernames Payment Information Government IDs IP Addresses Site Activity Company Information
  • Records: 363,562
  • Lines: 10,773,193
  • Size: 1.62 GB
  • Passwords: BCrypt
  • Cracked: 0%

Frequently Asked Questions

A data breach is unauthorized access to data (often involving account takeover, malware, or misconfigured infrastructure). A data leak is exposure of data due to mistakes like public cloud storage, open databases, or accidental publishing. A database dump is a packaged dataset that may come from a breach, leak, scraping, or aggregation.

Change passwords for any affected accounts immediately, prioritizing email, banking, and any account that shares the same password. Enable multi-factor authentication wherever possible. Monitor your accounts for suspicious activity and consider placing a fraud alert or credit freeze if financial data was exposed.

Start with containment and verification: confirm what data was exposed, identify the entry point, rotate credentials (especially SSO, VPN, email), and enforce MFA. Then investigate affected systems, notify stakeholders as required, and harden controls to prevent recurrence. A structured incident response plan helps keep the work measurable and compliant.

Dark web monitoring helps you spot exposure signals early — before stolen data is widely reused for account takeover or targeted attacks. Monitoring complements vulnerability management by revealing when attackers already have leverage. Pair it with continuous attack surface monitoring and strong Asset Discovery to reduce blind spots.

Not always. Some datasets are old, incomplete, or derived from third parties. However, any exposure increases risk because credentials and personal data can be reused indefinitely. Treat it as a priority signal: rotate credentials, enforce MFA, review suspicious logins, and audit the systems that could have produced the data.

SynScan helps you connect the dots between attack surface exposure, vulnerabilities, and breach signals so you can prioritize remediation and reduce the chance of repeat incidents.