Breach Intelligence

2,852

Total breached databases

In November 2013, the makers of gaming live streaming and recording software XSplit was compromised in an online attack. The data breach leaked almost 3M names, email addresses, usernames and hashed passwords.
  • Data: Email Addresses Names Passwords Usernames
  • Records: 2,992,447
  • Lines: 2,992,447
  • Size: 249.45 MB
  • Passwords: SHA-1
  • Cracked: 99%
In approximately July 2020, the US-based online alcohol delivery service Drizly suffered a data breach. The data was sold online before being extensively redistributed and contained 2.5 million unique email addresses alongside names, physical and IP addresses, phone numbers, dates of birth and passwords stored as bcrypt hashes.
  • Data: Birthdates Device Information Email Addresses IP Addresses Names Passwords Phone Numbers Physical Locations
  • Records: 2,479,145
  • Lines: 2,479,245
  • Size: 1.29 GB
  • Passwords: BCrypt
  • Cracked: 35%
In September 2018, a Minecraft-based gaming community PixelmonMod.com experienced a data breach. A file surfaced on the web with 248,033 user accounts compromising emails and passwords. The owners of the website have not made an official statement yet, nevertheless the database content had not been found in previously leaked files.
  • Data: Email Addresses Passwords Usernames
  • Records: 248,428
  • Lines: 248,464
  • Size: 16.56 MB
  • Passwords: PHPass
  • Cracked: 68%
In March 2020, the Irish gym management software company Glofox suffered a data breach which exposed 2.3M membership records. The data included email addresses, names, phone numbers, genders, dates of birth and passwords stored as unsalted MD5 hashes.
  • Data: Birthdates Email Addresses Genders Names Passwords Phone Numbers
  • Records: 2,578,004
  • Lines: 2,579,834
  • Size: 2.58 GB
  • Passwords: MD5
  • Cracked: 97%
In approximately 2011, data was allegedly obtained from the Chinese gaming website known as Duowan.com and contained 2.6M accounts. Whilst there is evidence that the data is legitimate, due to the difficulty of emphatically verifying the Chinese breach it has been flagged as "unverified". The data in the breach contains email addresses, user names and plain text passwords.
  • Data: Email Addresses Passwords Usernames
  • Records: 8,307,650
  • Lines: 8,307,711
  • Size: 444.46 MB
  • Passwords: Plaintext
In 2017, Warmane, a World of Warcraft private server, was breached, leading to the leak of 852,191 user records. The compromised data included plaintext passwords and email addresses. The format of the leaked information was email:password.
  • Data: Email Addresses Passwords
  • Records: 1,977,607
  • Lines: 1,977,640
  • Size: 113.81 MB
  • Passwords: Plaintext
In February 2023, the tech camps for kids service iD Tech had almost 1M records posted to a popular hacking forum. The data included 415k unique email addresses, names, dates of birth and plain text passwords which appear to have been breached in the previous month. iD Tech did not respond to multiple attempts to report the incident.
  • Data: Birthdates Email Addresses Names Passwords
  • Records: 990,276
  • Lines: 992,254
  • Size: 421.86 MB
  • Passwords: Plaintext

Frequently Asked Questions

A data breach is unauthorized access to data (often involving account takeover, malware, or misconfigured infrastructure). A data leak is exposure of data due to mistakes like public cloud storage, open databases, or accidental publishing. A database dump is a packaged dataset that may come from a breach, leak, scraping, or aggregation.

Change passwords for any affected accounts immediately, prioritizing email, banking, and any account that shares the same password. Enable multi-factor authentication wherever possible. Monitor your accounts for suspicious activity and consider placing a fraud alert or credit freeze if financial data was exposed.

Start with containment and verification: confirm what data was exposed, identify the entry point, rotate credentials (especially SSO, VPN, email), and enforce MFA. Then investigate affected systems, notify stakeholders as required, and harden controls to prevent recurrence. A structured incident response plan helps keep the work measurable and compliant.

Dark web monitoring helps you spot exposure signals early — before stolen data is widely reused for account takeover or targeted attacks. Monitoring complements vulnerability management by revealing when attackers already have leverage. Pair it with continuous attack surface monitoring and strong Asset Discovery to reduce blind spots.

Not always. Some datasets are old, incomplete, or derived from third parties. However, any exposure increases risk because credentials and personal data can be reused indefinitely. Treat it as a priority signal: rotate credentials, enforce MFA, review suspicious logins, and audit the systems that could have produced the data.

SynScan helps you connect the dots between attack surface exposure, vulnerabilities, and breach signals so you can prioritize remediation and reduce the chance of repeat incidents.