Breach Intelligence

6,875

Total breached databases

In 2015, womencup.fr allegedly suffered a data breach. Womencup.fr was the website of the Women's Cup, a French women's charity sailing regatta. Reports suggest a public WordPress database dump exposed roughly 750 individuals, including email addresses, usernames, geographic locations and site activity, along with a small number of password hashes (phpass).
  • Date: 2015
  • Domain: womencup.fr
  • Country: France
  • Category: Sports
  • Data: Email Addresses Passwords Geographic Locations Usernames Site Activity
  • Records: 1,964
  • Lines: 8,472
  • Size: 7.07 MB
  • Passwords: PHPass
  • Cracked: 0%
In June 2025, the JDIH portal of the North Sulawesi Provincial Government (jdih.sulutprov.go.id) allegedly suffered a data breach. The site is the official Legal Documentation and Information Network (JDIH) portal of Indonesia's North Sulawesi Province, publishing regional regulations and legal documents. It has been reported that the incident was carried out by a hacktivist group as a form of protest, and that the exposed database included an administrator account comprising a username, a full name, and an MD5-hashed password.
  • Date: Jun 2025
  • Domain: jdih.sulutprov.go.id
  • Threat Actor: V FOR VENDETTA CYBER TEAM
  • Country: Indonesia
  • Category: Government
  • Data: Passwords Names Usernames
  • Records: 1
  • Lines: 175,270
  • Size: 4.26 MB
  • Passwords: MD5
  • Cracked: 0%
In July 2026, the Russian VPN service SplitVPN (formerly known as NotVPN) allegedly suffered a data breach. SplitVPN is a VPN service used to bypass internet restrictions, with a user base concentrated in Russia. It has been reported that the incident exposed approximately 870,000 unique email addresses, along with names, usernames, geographic locations, languages, IP addresses and a small number of account passwords (stored in both plaintext and bcrypt-hashed form). Reports also suggest the wider dump included partial payment card details and device information.
  • Data: Email Addresses Passwords Names Geographic Locations Usernames IP Addresses Site Activity Languages
  • Records: 1,006,499
  • Lines: 151,981,152
  • Size: 16.18 GB
  • Passwords: BCrypt, Plaintext
In March 2020, data on Iranian users of Telegram and Instagram was allegedly exposed through an unsecured Elasticsearch cluster and later shared on a hacking forum. Telegram is officially blocked in Iran, and reports suggest the data was collected through unofficial third-party forks of the Telegram app rather than from Telegram itself. It has been reported that approximately 46.8 million records were exposed, covering around 35 million unique phone numbers, with many accounts appearing more than once. The compromised data includes names, phone numbers, Telegram and Instagram usernames and account IDs, profile bios and last-activity dates. No passwords were included.
  • Data: Email Addresses Names Phone Numbers Geographic Locations Government IDs Site Activity Social Profiles Bios
  • Records: 47,869,120
  • Lines: 96,471,969
  • Size: 45.01 GB
  • Passwords: No
Sometime before 2019, ACTIVE Network — a sports and event registration platform — allegedly suffered a data breach. Reports suggest approximately 22 million user records were exposed, including email addresses, SHA-1 password hashes, names, phone numbers, geographic locations and account activity dates.
  • Date: 2019
  • Country: United States
  • Category: Sports
  • Data: Email Addresses Passwords Names Phone Numbers Physical Locations Geographic Locations Site Activity
  • Records: 22,046,328
  • Lines: 23,606,696
  • Size: 3.96 GB
  • Passwords: SHA-1, Unknown
In July 2016, the Justice and Development Party (AKP), Turkey's ruling political party, allegedly suffered a data breach attributed to the hacker known as Phineas Fisher, after which the party's email archive was published by WikiLeaks. Reports suggest the leak comprised roughly 300,000 emails from the party's mail server, exposing approximately 408,000 unique email addresses. The exposed data reportedly includes email addresses, names and message contents, along with party membership records containing government ID numbers, phone numbers, physical addresses, birthdates, genders and family details.
  • Data: Email Addresses Names Phone Numbers Physical Locations Geographic Locations Government IDs Family Members Relationship Statuses Health Information Genders Job Information Birthdates
  • Records: 413,553
  • Lines: 144,784,439
  • Size: 9.66 GB
  • Passwords: No
In October 2018, the New York State voter registration database, maintained by the New York State Board of Elections (ny.gov), allegedly suffered a data breach. It has been reported that the data was obtained through unauthorized access to the state's SSH/SFTP servers. Approximately 16 million voter records were exposed, including full names, dates of birth, genders, residential and previous physical addresses, political party affiliations, and state-issued voter ID numbers. The data did not include passwords.
  • Date: Oct 2018
  • Domain: ny.gov
  • Threat Actor: Omnipotent
  • Country: United States
  • Category: Government
  • Data: Names Physical Locations Geographic Locations Government IDs Genders Site Activity Birthdates Political Affiliation
  • Records: 15,980,005
  • Lines: 15,980,005
  • Size: 5.51 GB
  • Passwords: No

Frequently Asked Questions

A data breach is unauthorized access to data (often involving account takeover, malware, or misconfigured infrastructure). A data leak is exposure of data due to mistakes like public cloud storage, open databases, or accidental publishing. A database dump is a packaged dataset that may come from a breach, leak, scraping, or aggregation.

Change passwords for any affected accounts immediately, prioritizing email, banking, and any account that shares the same password. Enable multi-factor authentication wherever possible. Monitor your accounts for suspicious activity and consider placing a fraud alert or credit freeze if financial data was exposed.

Start with containment and verification: confirm what data was exposed, identify the entry point, rotate credentials (especially SSO, VPN, email), and enforce MFA. Then investigate affected systems, notify stakeholders as required, and harden controls to prevent recurrence. A structured incident response plan helps keep the work measurable and compliant.

Dark web monitoring helps you spot exposure signals early — before stolen data is widely reused for account takeover or targeted attacks. Monitoring complements vulnerability management by revealing when attackers already have leverage. Pair it with continuous attack surface monitoring and strong Asset Discovery to reduce blind spots.

Not always. Some datasets are old, incomplete, or derived from third parties. However, any exposure increases risk because credentials and personal data can be reused indefinitely. Treat it as a priority signal: rotate credentials, enforce MFA, review suspicious logins, and audit the systems that could have produced the data.

SynScan helps you connect the dots between attack surface exposure, vulnerabilities, and breach signals so you can prioritize remediation and reduce the chance of repeat incidents.