Breach Intelligence

6,875

Total breached databases

In approximately June 2017, the Website for Veterans to find a job known as RecruitMilitary suffered a data breach. The breach included Full names, Email addresses and Phone numbers. In total, 850k users were affected.
  • Data: Email Addresses Names Phone Numbers
  • Records: 850,934
  • Lines: 5,105,617
  • Size: 271.28 MB
  • Passwords: No
In 2011, a dataset titled “USA Consumer” surfaced, containing approximately 11,884,804 records of consumer marketing data from across the United States. The information appeared to originate from commercial lead-generation sources. Among the exposed data were full names, email addresses, phone numbers, physical addresses, gender, and partial birthdates. No passwords or financial information were included. The dataset is believed to have been compiled and circulated by data brokers for marketing purposes.
  • Date: 2011
  • Domain: usa.gov
  • Country: United States
  • Category: Professional & Corporate
  • Data: Birthdates Email Addresses Genders Names Phone Numbers Physical Locations
  • Records: 11,884,322
  • Lines: 11,884,804
  • Size: 1.34 GB
  • Passwords: No
In mid-2021, Risk Based Security reported on a database sourced from Ducks Unlimited being traded online. The data dated back to January 2021 and contained 1.3M unique email addresses across both a membership list and a list of website users. Impacted data included names, phones numbers, physical addresses, dates of birth and passwords stored as unsalted MD5 hashes.
  • Data: Birthdates Email Addresses Names Passwords Phone Numbers Physical Locations
  • Records: 1,994,936
  • Lines: 1,994,937
  • Size: 531.33 MB
  • Passwords: SHA-1
  • Cracked: 0%
In October 2019, the Minnesota-based news service StarTribune suffered a data breach which was subsequently sold on the dark web. The breach exposed over 2 million unique email addresses alongside names, usernames, physical addresses, dates of birth, genders and passwords stored as bcrypt hashes.
  • Data: Birthdates Email Addresses Genders Names Passwords Physical Locations Usernames
  • Records: 6,577,010
  • Lines: 26,288
  • Size: 5.8 GB
  • Passwords: BCrypt
  • Cracked: 21%
In approximately December 2019, the betting & sports news website ActionNetwork suffered a data breach that impacted 693k users. The breach included Email addresses, Full names, Phone numbers, Usernames and Passwords stored as bcrypt hashes.
  • Data: Email Addresses Names Passwords Phone Numbers Usernames
  • Records: 693,637
  • Lines: 693,795
  • Size: 830.76 MB
  • Passwords: BCrypt
  • Cracked: 0%
In June 2017, RansomHub reportedly carried out a data breach, exposing approximately 12,316,882 records. The compromised data included information from various locations across the United States, such as California, Washington, Virginia, and Utah. Among the leaked information were names, physical locations, birthdates, and driving license numbers.
  • Data: Names Physical Locations Birthdates Driving License Numbers
  • Records: 12,316,882
  • Lines: 12,316,882
  • Size: 1.95 GB
  • Passwords: No
The No Fly List is a small subset of the U.S. government Terrorist Screening Database (also known as the terrorist watchlist) that contains the identity information of known or suspected terrorists. This database is maintained by the FBIs Terrorist Screening Center. On January 19, 2023, Swiss hacker "maia arson crimew" reported that she had gained access to 2019 versions of the No Fly List stored by CommuteAir on an unsecured cloud server. The leak led to the exposure of data including Full names and Dates of Birth. In total, 1.8 million people were affected. Full credit for this hack goes to "maia arson crimew".
  • Date: 2023
  • Domain: commuteair.com
  • Threat Actor: maia arson crimew
  • Country: United States
  • Category: Government
  • Source: crimew.gay
  • Data: Birthdates Names
  • Records: 1,817,231
  • Lines: 1,817,233
  • Size: 86.73 MB
  • Passwords: No

Frequently Asked Questions

A data breach is unauthorized access to data (often involving account takeover, malware, or misconfigured infrastructure). A data leak is exposure of data due to mistakes like public cloud storage, open databases, or accidental publishing. A database dump is a packaged dataset that may come from a breach, leak, scraping, or aggregation.

Change passwords for any affected accounts immediately, prioritizing email, banking, and any account that shares the same password. Enable multi-factor authentication wherever possible. Monitor your accounts for suspicious activity and consider placing a fraud alert or credit freeze if financial data was exposed.

Start with containment and verification: confirm what data was exposed, identify the entry point, rotate credentials (especially SSO, VPN, email), and enforce MFA. Then investigate affected systems, notify stakeholders as required, and harden controls to prevent recurrence. A structured incident response plan helps keep the work measurable and compliant.

Dark web monitoring helps you spot exposure signals early — before stolen data is widely reused for account takeover or targeted attacks. Monitoring complements vulnerability management by revealing when attackers already have leverage. Pair it with continuous attack surface monitoring and strong Asset Discovery to reduce blind spots.

Not always. Some datasets are old, incomplete, or derived from third parties. However, any exposure increases risk because credentials and personal data can be reused indefinitely. Treat it as a priority signal: rotate credentials, enforce MFA, review suspicious logins, and audit the systems that could have produced the data.

SynScan helps you connect the dots between attack surface exposure, vulnerabilities, and breach signals so you can prioritize remediation and reduce the chance of repeat incidents.