Breach Intelligence

2,855

Total breached databases

On February 9, 2022, the Croatian telecommunications platform a1.hr experienced a data breach. The platform is known for providing mobile services. It has been reported that the breach exposed approximately 183,446 lines of data. Among the compromised data were names, national identification numbers (OIB), mobile phone numbers, and geographic locations.
  • Date: Feb 9, 2022
  • Domain: a1.hr
  • Threat Actor: Riptide
  • Country: Croatia
  • Category: Telecommunications
  • Records Announced: 183,446
  • Source: breached.hn
  • Data: Names Phone Numbers Geographic Locations
  • Imported:
  • Passwords: No
In mid-2021, the "vintage messaging reborn" service Phoenix suffered a data breach that exposed 75k unique email addresses. The breach also exposed IP addresses, usernames and passwords.
  • Data: Email Addresses IP Addresses Passwords Usernames
  • Imported:
  • Passwords: Unknown
In 2024, the website megamodels.pl, dedicated to Polish modeling, experienced a data breach. The leaked data comprised an m_user.sql file with 182,000 entries, totaling a size of 65MB. Among the compromised data were names, usernames, email addresses, geographic locations, passwords, and phone numbers. The password hashes appear to be represented in Hash format.
  • Data: Email Addresses Passwords Names Geographic Locations Usernames Government IDs Profile Photos
  • Imported:
  • Passwords: SHA-1
  • Cracked: 0%
On January 27, 2023, Gererseul.com, a leading rent management application, reportedly suffered a data breach. The incident exposed 173,327 records. Among the compromised data were email addresses, physical locations, and hashed passwords.
  • Data: Email Addresses Passwords Names Phone Numbers Usernames Birthdates
  • Imported:
  • Passwords: Unknown
In 2024, the financial services company FICO, known for providing analytics and decision management technology, experienced a data breach. The incident reportedly exposed approximately 170,000 lines of data. Among the compromised information were names, physical locations, phone numbers, fax numbers, email addresses, Social Security numbers, birthdates, credit scores, and other personal and financial details.
  • Date: 2024
  • Domain: fico.com
  • Threat Actor: TA
  • Category: Finance & Payments
  • Records Announced: 172,763
  • Source: breached.hn
  • Data: Email Addresses Names Phone Numbers Physical Locations Financial Information Social Security Numbers Marital Statuses Genders Salutations Job Information Fax Numbers Birthdates
  • Imported:
  • Passwords: No
In May 2026, the dental benefits administrator DentaQuest was the target of a ShinyHunters "pay or leak" extortion campaign that resulted in the group publicly publishing hundreds of gigabytes of data allegedly obtained from the company. The data included 2.6M unique email addresses along with names, addresses and phone numbers. Much of the data appeared in healthcare enrollment files (ASC X12 transaction sets) containing Medicaid IDs, while additional data appeared in member records and related files. DentaQuest acknowledged "a cybersecurity incident involving unauthorized access to a limited portion of our network", and advised they had contained the attack and mitigated the threat.
  • Date: May 23, 2026
  • Domain: dentaquest.com
  • Threat Actor: ShinyHunters
  • Country: United States
  • Category: Healthcare
  • Records Announced: 2,553,599
  • Source: haveibeenpwned.com
  • Data: Email Addresses Names Phone Numbers Physical Locations Geographic Locations Government IDs Insurance Information Genders Birthdates
  • Imported:
  • Number of lines: 11,249,904
  • Size: 1.55 GB
  • Passwords: ?

Frequently Asked Questions

A data breach is unauthorized access to data (often involving account takeover, malware, or misconfigured infrastructure). A data leak is exposure of data due to mistakes like public cloud storage, open databases, or accidental publishing. A database dump is a packaged dataset that may come from a breach, leak, scraping, or aggregation.

Change passwords for any affected accounts immediately, prioritizing email, banking, and any account that shares the same password. Enable multi-factor authentication wherever possible. Monitor your accounts for suspicious activity and consider placing a fraud alert or credit freeze if financial data was exposed.

Start with containment and verification: confirm what data was exposed, identify the entry point, rotate credentials (especially SSO, VPN, email), and enforce MFA. Then investigate affected systems, notify stakeholders as required, and harden controls to prevent recurrence. A structured incident response plan helps keep the work measurable and compliant.

Dark web monitoring helps you spot exposure signals early — before stolen data is widely reused for account takeover or targeted attacks. Monitoring complements vulnerability management by revealing when attackers already have leverage. Pair it with continuous attack surface monitoring and strong Asset Discovery to reduce blind spots.

Not always. Some datasets are old, incomplete, or derived from third parties. However, any exposure increases risk because credentials and personal data can be reused indefinitely. Treat it as a priority signal: rotate credentials, enforce MFA, review suspicious logins, and audit the systems that could have produced the data.

SynScan helps you connect the dots between attack surface exposure, vulnerabilities, and breach signals so you can prioritize remediation and reduce the chance of repeat incidents.