Breach Intelligence

6,875

Total breached databases

Alcon 2026

Alcon 2026

In August 2026, the Alcon eye care company was named in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly sourced from Alcon containing 218k unique email addresses along with other largely corporate B2B contact fields, including name, phone number and physical address.
  • Data: Email Addresses Names Phone Numbers Physical Locations Geographic Locations Genders Job Information Company Information Languages
  • Records: 1,257,103
  • Lines: 28,267,053
  • Size: 7.53 GB
  • Passwords: No
JCPenney 2026

JCPenney 2026

In June 2026, US retailer JCPenney and associated brands under Catalyst Brands and Authentic Brands Group were allegedly targeted in a ShinyHunters "pay or leak" extortion campaign. Reports suggest the data was obtained through the exploitation of a critical zero-day vulnerability in Oracle PeopleSoft and, after no ransom was paid, published publicly. The exposed records related primarily to internal HR systems and impacted current and former employees. It has been reported that approximately 368,000 records were compromised, including corporate and personal email addresses, usernames, names, dates of birth, Social Security numbers, phone numbers, home addresses and job information.
  • Data: Email Addresses Names Phone Numbers Physical Locations Geographic Locations Usernames Government IDs Social Security Numbers Job Information Birthdates
  • Records: 6,626,146
  • Lines: 26,152,787
  • Size: 17.25 GB
  • Passwords: No
Moody Bible Institute 2026

Moody Bible Institute 2026

In June 2026, Moody Bible Institute, a Chicago-based evangelical Christian college, allegedly suffered a data breach as part of a ShinyHunters "pay or leak" extortion campaign. Reports suggest the compromised data spanned enrollment, donor relations, payroll and communications systems and was later published publicly. Approximately 2.3 million individuals were affected, with exposed data including names, email addresses, phone numbers, physical addresses, dates of birth, genders and marital statuses relating to donors, supporters, students and alumni.
  • Data: Email Addresses Names Phone Numbers Physical Locations Geographic Locations Genders Birthdates
  • Records: 3,244,238
  • Lines: 22,687,631
  • Size: 4.93 GB
  • Passwords: No
Orange Romania 2025

Orange Romania 2025

In February 2025, Orange Romania (orange.ro) allegedly suffered a data breach. Reports suggest approximately 566,801 unique email addresses were affected, with exposed data including email addresses, geographic locations.
  • Data: Email Addresses Geographic Locations
  • Records: 563,536
  • Lines: 52,225,007
  • Size: 3.71 GB
  • Passwords: No
Rightbiz 2023

Rightbiz 2023

In June 2023, the UK business-for-sale marketplace Rightbiz (rightdev.co.uk / rightbiz.co.uk) allegedly suffered a data breach that was subsequently published on a popular hacking forum. Reports suggest the incident exposed approximately 65,000 individuals, with the data including email addresses, names, phone numbers, physical and geographic locations, usernames, genders, IP addresses and company information. A subset of member and broker accounts also included salted MD5 password hashes. Rightbiz reportedly did not respond to multiple attempts to disclose the incident.
  • Data: Email Addresses Passwords Names Phone Numbers Physical Locations Geographic Locations Usernames Genders IP Addresses Site Activity Websites Company Information Bios
  • Records: 68,675
  • Lines: 18,087,865
  • Size: 185.02 MB
  • Passwords: MD5 Salted
  • Cracked: 0%

University of the Philippines Mindanao 2025

In November 2025, data from the Student Records System of the University of the Philippines Mindanao (upmin.edu.ph), a public research university in the Philippines, was allegedly leaked and published on a hacking forum. Reports suggest the breach exposed the university's student and staff databases. Approximately 10,000 individuals were allegedly affected, with exposed data including email addresses, full names, usernames, plaintext and hashed passwords, phone numbers, home addresses, birthdates, genders, nationalities, religions and civil-status information.
  • Date: Nov 16, 2025
  • Domain: upmin.edu.ph
  • Threat Actor: 0xSeve
  • Country: Philippines
  • Category: Education
  • Data: Email Addresses Passwords Names Phone Numbers Physical Locations Geographic Locations Usernames Relationship Statuses Genders Religions Site Activity Birthdates Nationalities
  • Records: 40,946
  • Lines: 3,291,384
  • Size: 238.95 MB
  • Passwords: Plaintext, MD5, Django
UTL Lille 2024

UTL Lille 2024

In June 2024, the French association UTL Lille (Université du Temps Libre de Lille, utllille.fr), which organises lifelong-learning lectures and activities, allegedly suffered a data breach. Reports suggest a full database export was published on hacking forums, exposing approximately 5,100 individuals. The compromised data reportedly included email addresses, names, phone numbers, physical and geographic locations, dates of birth, genders, job information, IP addresses, site activity, and account passwords stored as MySQL hashes.
  • Date: Jun 20, 2024
  • Domain: utllille.fr
  • Country: France
  • Category: Education
  • Data: Email Addresses Passwords Names Phone Numbers Physical Locations Geographic Locations Genders IP Addresses Site Activity Job Information Company Information Birthdates
  • Records: 24,786
  • Lines: 164,466
  • Size: 22.63 MB
  • Passwords: MySQL
  • Cracked: 0%

Frequently Asked Questions

A data breach is unauthorized access to data (often involving account takeover, malware, or misconfigured infrastructure). A data leak is exposure of data due to mistakes like public cloud storage, open databases, or accidental publishing. A database dump is a packaged dataset that may come from a breach, leak, scraping, or aggregation.

Change passwords for any affected accounts immediately, prioritizing email, banking, and any account that shares the same password. Enable multi-factor authentication wherever possible. Monitor your accounts for suspicious activity and consider placing a fraud alert or credit freeze if financial data was exposed.

Start with containment and verification: confirm what data was exposed, identify the entry point, rotate credentials (especially SSO, VPN, email), and enforce MFA. Then investigate affected systems, notify stakeholders as required, and harden controls to prevent recurrence. A structured incident response plan helps keep the work measurable and compliant.

Dark web monitoring helps you spot exposure signals early — before stolen data is widely reused for account takeover or targeted attacks. Monitoring complements vulnerability management by revealing when attackers already have leverage. Pair it with continuous attack surface monitoring and strong Asset Discovery to reduce blind spots.

Not always. Some datasets are old, incomplete, or derived from third parties. However, any exposure increases risk because credentials and personal data can be reused indefinitely. Treat it as a priority signal: rotate credentials, enforce MFA, review suspicious logins, and audit the systems that could have produced the data.

SynScan helps you connect the dots between attack surface exposure, vulnerabilities, and breach signals so you can prioritize remediation and reduce the chance of repeat incidents.