Data as of July 10, 2026. About a 25-minute read. Every chart and number here is free to reuse with attribution (CC BY 4.0).
A welcome, from the person who counted
Hello. I am Devanand, and I run XposedOrNot, a free, open-source breach search and notification service. This is our first half-yearly breach coverage report, and before the numbers, one sentence on what this half was about:
The theme of H1 2026 is “the gap is closing at both ends”: breach data is surfacing faster than it ever has, and what surfaces is more personal than it used to be.
Everything below either supports that sentence or honestly complicates it. This report is free, ungated, and reproducible: no email required for the PDF, and every first-party figure comes with the query that produced it. If you find a number that does not reproduce, email me at deva@xposedornot.com and I will fix it the same day. And an obvious disclosure, since the data here keeps pointing at standing alerts and alerts are what I build: treat that as a finding you can check rather than advice you must trust. Every number carries its query, and everything Part Three recommends works with any reputable alerting service, ours included.
At a glance
- 101 breaches and 1,024,063,499 records entered the index between January 1 and June 30, the biggest half-year since I started keeping count. For scale: roughly 65 records every second, around the clock, for six months.
- The rank change of the half: in fresh breaches, identity data overtook passwords. Phone numbers showed up in 57.4% of H1’s breaches and home addresses in 50.5%; passwords in only 27.7%.
- Median gap from breach to searchable-here: 66 days (34 days for breaches that actually happened in 2026). A fast lane now exists that did not before. The odd part: indexing sped up while the median breach got smaller (922,685 records vs the catalog’s 1,138,821).
What it means: checking your exposure once was always a weak strategy; a 66-day fast lane makes standing alerts the only approach that matches the data’s actual speed, and the identity shift means the leaked data increasingly cannot be rotated away, only known about and defended against.
And what did not change: email addresses remain the universal constant, present in every one of H1’s 101 breaches, and in all 763 breaches across the full catalog. The join key is stable; everything built on it still applies.
The report has two halves, kept apart on purpose: Part One is my data, what actually entered the index, counted. Part Two is the world’s data, the half-year’s big incidents, the actor groups, the industry reports, every claim with a source link. Where a number is an attacker’s claim rather than a confirmed figure, it says so. Where my data cannot support a conclusion, the caveats section says that too.
Where to start: if you only read one section, read the lag analysis in Part One. If you just want to know about yourself, skip to Part Three and the ten-second check. Journalists: figures are numbered, every caption carries its source, and there is a stat sheet.
In this report: Method · Part One: the numbers (monthly, sectors, sizes, the lag analysis, what leaked) · Part Two: the half out there (the xonPulse view, headline incidents, actor claims vs confirmations, industry reports, regulators) · Part Three: what to do · FAQ · Appendices (the script, the sources, all 101 breaches)
Five things in here you might not expect:
- Passwords are no longer the most-exposed data type. They now rank sixth, behind phone numbers and home addresses.
- Most of what leaked this half cannot be fixed by changing a password. Nearly half of these breaches leaked a complete contact identity (name, phone, home address) as a set.
- A breach that happens in 2026 typically becomes searchable in about a month. It used to take years.
- The half’s biggest claimed breach is in nobody’s index. A ransom was paid and the data never surfaced.
- For every ransomware victim that confirms an attack, roughly nine more are only claimed on leak sites.
Two findings from the catalog lead the report:
Finding one: fresh breach data surfaces fast now, and the index keeps up. Across the 101 entries added this half, the median gap between a breach happening and being searchable here was 66 days. For the 58 breaches that actually happened in 2026: 34 days. The all-time catalog median of 1,591 days mixes slower historical surfacing with my own backfilling of older breaches; the fast lane is real, and I say exactly what it measures.
Finding two: fresh breaches leak identity faster than they leak passwords. Phone numbers appeared in 57% of H1’s breaches and physical addresses in 50%, while passwords appeared in just 28%. The advice ecosystem is still built around “change your password.” The data being stolen has moved on to the things you cannot change.
Everything below unpacks those two findings, the numbers behind them, and the half-year context around them.
Method, before anything else
Reports in this genre usually save the methodology for the fine print. Mine goes first, because every claim that follows depends on it.
What “added to XON in H1” means. Every entry in the catalog carries two dates: when the breach occurred (breach date) and when the data became searchable in our index (added date). This report’s first-party window is entries with an added date between 2026-01-01 and 2026-06-30. Two distinct things land in that window, and this report keeps them separate: breaches surfacing (newly public data, indexed close to its public appearance) and breaches we backfilled (data long public elsewhere that our catalog absorbed this half). An added date is my index’s fact; it is not, by itself, proof of when the world first saw the data. Which entries count as backfill was verified against public breach lists while writing this report, not guessed, and backfills are called backfills throughout.
What a “record” is. A record is a row of exposed data, not a person. Compilations and scrapes double-count individuals across sources; I never translate records into people, and neither should you.
What the catalog is and is not. 763 breaches as of July 10, 2026, verified before indexing (100 of the 101 H1 additions are verified; the one exception, Intersport, is flagged unverified and labeled as such in the catalog). We index publicly surfaced breach data; we do not purchase data from criminals. Sensitive breaches are search-restricted. Entries include ordinary breaches, compilations, scrapes, and, new this half, a stealer-log collection (the output of malware that silently copies passwords and cookies from infected devices), each labeled with its type because the type changes what a victim should do.
Reproducibility. The catalog is queryable by anyone, keyless and free. The appendix contains the analysis script; it reproduces every first-party table in this report from one pull.
What I am sure of, and what I am not. Two kinds of numbers appear in this report, and they deserve different trust. Part One’s figures are counts, not estimates: exact tallies over my own catalog, reproducible to the digit by anyone with curl. Part Two’s figures are mostly the world’s reporting: company confirmations, regulator filings, tracker tallies, and attacker claims, each labeled as what it is, each linked to its source, and none of them mine to guarantee. One slice of Part Two sits in between: counts over my own xonPulse news curation, which are exact counts of an editorial selection, and say so where they appear. When a table mixes the two, the columns say which is which. And one refusal, on the record: my intake grew roughly 4x year over year, and I am not going to tell you how much of that is the world leaking faster versus my indexing getting better, because the data genuinely cannot separate the two. A report that cannot say “I do not know” cannot be trusted when it says “I know.”
First-time readers: “breach” versus “record” versus “exposure” trips everyone at first. A breach is an incident; a record is a leaked row of data; your exposure is the set of breaches containing your identifiers. Long-time breach-report readers can skip ahead with our blessing. Numbers are as of July 10, 2026 and will drift as the catalog grows; run it fresh and today’s truth wins. The xonPulse feed behind Figure 6 is equally public: `curl https://api.xposedornot.com/v1/xon-pulse`.
Part One: What I Added, Counted
The half by month
Month | Breaches | Records | Largest addition | Median lag | Fresh (2026 breaches) |
January | 6 | 42,786,195 | SoundCloud (29.9M) | 60 days | 2 of 6 |
February | 21 | 144,758,102 | UnderArmour (73.1M) | 231 days | 4 of 21 |
March | 16 | 27,011,404 | R2GamesForum (5.2M) | 1,328 days | 6 of 16 |
April | 22 | 83,233,701 | Gravatar (25.1M, a backfill) | 34 days | 17 of 22 |
May | 13 | 391,480,688 | PeopleDataLabs (179.1M) | 57 days | 10 of 13 |
June | 23 | 334,793,409 | AlienStealerLogs (299.6M) | 57 days | 19 of 23 |
H1 total | 101 | 1,024,063,499 | 66 days | 58 of 101 |
Figure 1. Breaches and records added per month, H1 2026 (n=101; source: catalog query, Appendix A).
Several shapes worth noticing. Count is steady after a slow January: roughly one new indexed breach every 1.8 days, and an average of 5.65 million newly indexed records per day across the half. Records are lumpy: May and June alone carried just under 71% of the half’s volume, because record totals are dominated by a handful of giants (the concentration table below makes this precise). By quarter: Q1 added 43 breaches (214.5M records), Q2 added 58 (809.5M), growth on both axes.
And the median-lag column tells a story of its own: months have personalities. March was a backfill month, median lag 1,328 days, dominated by older breaches (most already public in other indexes for years) being absorbed into the catalog. April ran at a 34-day median with 17 of its 22 additions being 2026 breaches, the freshest month of the half. The index breathes in both directions at once, surfacing the new and deepening the old, and the freshness section below keeps the two strictly apart.
The last five halves, for scale (every future edition extends this table):
Period | Breaches added | Records added |
H1 2024 | 72 | 805,925,709 |
H2 2024 | 51 | 561,132,387 |
H1 2025 | 25 | 224,259,752 |
H2 2025 | 34 | 65,924,975 |
H1 2026 | 101 | 1,024,063,499 |
H1 2026 is the largest half on record for the index, on both axes: roughly 4x H1 2025’s count (25) and 40% above the previous count peak, H1 2024 (72). Read the whole column, though, and the honest story is a 2025 trough between two peaks, not a smooth explosion. The caveat from the method section applies at full strength: this table measures my intake, which reflects both a faster-leaking world and the state of my indexing pipeline in each period, and I am not going to guess how much is which. Future editions extend this table, with the same caveat attached.
Who got breached: industry, counted both ways
All 18 sectors, both counts, one table:
Industry | Breaches | Records |
Retail | 17 | 99,127,251 |
Entertainment | 17 | 45,483,238 |
Information Technology | 13 | 365,693,140 |
Finance | 13 | 45,918,153 |
Education | 8 | 19,599,562 |
Miscellaneous | 6 | 300,510,350 |
Food | 4 | 12,200,930 |
Transport | 4 | 3,390,926 |
Telecommunication | 3 | 56,300,026 |
Hospitality | 3 | 7,919,451 |
News Media | 3 | 2,038,257 |
Health Care | 2 | 8,980,995 |
Electronics | 2 | 379,186 |
Music | 2 | 40,218,569 |
Sports | 1 | 9,812,566 |
Manufacturing | 1 | 116,353 |
Government | 1 | 6,368,946 |
Non-Profit/Charities | 1 | 5,600 |
Figure 2. All 18 sectors by breach count and by records, H1 2026 additions (n=101; source: catalog query, Appendix A).
The rankings flip between the two counts, a pattern I have documented across the full catalog: everyday consumer sectors lead by incident count, platforms lead by volume because platforms aggregate. Retail’s strong half by count (17 breaches, tied for first) is notable against its all-time third place. Miscellaneous’s 300 million records is almost entirely one entry, the AlienStealer collection, which gets its own section below. Finance, the sector everyone assumes leads, sits mid-table on both counts, consistent with the full-catalog finding that attackers at scale target availability, not prestige.
What is the same: Entertainment near the top by count, IT at the top by records, and the flip itself. The half rearranged the podium’s order without changing who stands on it, and continuity is a finding too.
The ten largest additions
Records | Entry | Sector | Breached | Added | The story |
299,646,818 | AlienStealerLogs | Misc | Feb-2025 | 15-Jun-2026 | Our first stealer-log collection; see its section below |
179,117,119 | PeopleDataLabs | IT | Jan-2019 | 31-May-2026 | A 2019 exposure, publicly searchable elsewhere since late 2019; a backfill for our catalog |
125,724,601 | LinkedInScrape-2021 | IT | Apr-2021 | 23-May-2026 | A scrape, labeled as one: public-ish data, aggregated into a weapon |
73,065,604 | UnderArmour | Retail | Nov-2025 | 14-Feb-2026 | A late-2025 breach surfacing within months |
49,295,990 | Charter | Telecom | May-2026 | 28-May-2026 | Breached and indexed inside a month; the acceleration finding, live |
29,968,497 | SoundCloud | Music | Dec-2025 | 27-Jan-2026 | |
25,934,104 | Addi | Finance | Mar-2026 | 31-May-2026 | |
25,104,710 | Gravatar | IT | Oct-2020 | 07-Apr-2026 | A 2020 breach, public elsewhere for years; a backfill for our catalog |
16,720,492 | Fotolog | Entertainment | Dec-2018 | 23-Feb-2026 | A dead platform’s data, still moving |
14,430,356 | McGrawHill | Education | Apr-2026 | 17-Apr-2026 | Part of the half’s education-sector storyline; see Part Two |
Three mega-entries (100M+) carried the half’s volume. The table also previews Part Two: Charter and McGraw Hill appear both in our index and in the half’s headline incidents. The counts attached to them differ between the two places (rows in our index, unique emails at other services, leak-site claims), and that difference is itself a lesson in reading breach numbers.
Size distribution: the long tail is the story
Size class | Entries |
Mega (100M+) | 3 |
Large (10M to 100M) | 11 |
Medium (1M to 10M) | 35 |
Small (100K to 1M) | 44 |
Tiny (under 100K) | 8 |
And the concentration, measured:
Slice | Share of H1 records |
Top 1 entry | 29.3% |
Top 3 entries | 59.0% |
Top 10 entries | 81.9% |
The other 91 entries | 18.1% |
The median H1 addition held 922,685 records (all-time catalog median: 1,138,821).
Figure 3. H1 additions by size class, and share of H1 records held by the largest entries (n=101; source: catalog query, Appendix A).
The three mega-entries hold most of the records; the 87 entries under 10 million records hold most of the incidents. This matters because exposure is personal: if the 200,000-record breach contains your password, the billion-record compilation is not your problem, that one is. A mid-sized breach hurts each of its victims just as much as a mega breach hurts each of its own. The difference is that nobody writes headlines about it, so nobody warns you. That is the strongest argument in our data for standing alerts over news-driven checking.
Freshness: the 66-day median, and what it does not mean
Of the 101 additions: 58 were breaches that occurred in 2026, 16 from 2025, and 27 older, reaching back to 2011. Lag between breach and indexing:
- Median: 66 days
- Fastest: 4 days
- 56 of 101 within 90 days
- 30 of 101 over a year, the longest at 5,190 days (a 2011 breach surfacing in 2026)
Here is the full distribution, H1 against the all-time catalog:
Lag bucket | H1 2026 additions | All-time catalog (763) |
Under 30 days | 22 (21.8%) | 39 (5.1%) |
30 to 90 days | 34 (33.7%) | 62 (8.1%) |
90 days to 1 year | 15 (14.9%) | 56 (7.3%) |
1 to 3 years | 7 (6.9%) | 117 (15.3%) |
Over 3 years | 23 (22.8%) | 489 (64.1%) |
Figure 4. Breach-to-surfacing lag distribution: H1 2026 additions (n=101) vs all-time catalog (n=763); shares of each window (source: catalog query, Appendix A).
Read the right-hand column first: across two decades of catalog, nearly two-thirds of entries carry an over-three-year gap between breach and our index (a figure that mixes slow public surfacing with my own backfilling; the method section explains how the two are kept apart). Now the left: over half of H1’s additions were searchable within 90 days of the breach. The distribution has split: a genuine fast lane for fresh breaches, running alongside deliberate backfill of the old.
The fresh lane, up close. Isolate the 58 entries that both occurred and surfaced in 2026: 197.9 million records, median lag 34 days, longest 167 days, median size 724,526 records. And their sector mix differs from the half overall: Finance leads the fresh cohort by count (13), ahead of Retail (8), IT (7), and Entertainment (7). When a 2026 breach surfaces, it surfaces in about a month, it is mid-sized, and noticeably often it is financial. That is what the current threat actually looks like, with the backfill filtered out.
Against the full catalog’s 1,591-day median, 66 days looks like a different universe, and it partly is: data is leaking, circulating, and surfacing faster, and indexing (ours included) has gotten faster at catching it. Two honest qualifiers. Recent additions are selected for freshness in a way the historical catalog is not; a 2026 breach cannot show a five-year lag yet. And the 30-entry long tail proves the old pattern is alive: PeopleDataLabs took seven years to surface in usable form.
If you quote one number from this report, quote it right. A breach that happened in 2026 typically became searchable in 34 days. The 66-day median covers everything added this half, including old breaches surfacing late. The 1,591-day catalog median describes two decades of history, not the present. "Fresh breaches now surface in about a month" is the accurate short version.
Both halves of that picture point the same direction for the person exposed. Faster surfacing means checking is finally worth doing often, which is what an alert automates. The long tail means a clean result today can stop being clean when 2019’s silence surfaces next May. This is not a product pitch dressed as analysis; it is why breach notification exists as a category.
What leaked: identity has overtaken credentials
Data types across the 101 H1 additions:
Data type | Breaches | Share |
Email addresses | 101 | 100% |
Names | 78 | 77.2% |
Phone numbers | 58 | 57.4% |
Physical addresses | 51 | 50.5% |
Usernames | 40 | 39.6% |
Passwords | 28 | 27.7% |
Dates of birth | 25 | 24.8% |
IP addresses | 19 | 18.8% |
Figure 5. Share of H1 2026 additions exposing each data type (n=101; source: catalog query, Appendix A).
And the combinations matter more than the singles, because identity theft runs on joined data. Counting co-occurrence within the same breach:
|
Identity kit exposed together |
H1 breaches |
Share |
|
Name + phone + physical address |
46 |
45.5% |
|
Email + date of birth |
25 |
24.8% |
|
Phone + date of birth |
12 |
11.9% |
A complete contact identity, enough to call you, mail you, and impersonate you convincingly, leaked as a set in nearly half of this half’s breaches.
Read those tables against the usual advice. “Change your password” addresses the 28%. Nothing you can do addresses the phone number in 57% of these breaches or the home address in half of them, because those do not rotate, and across the full catalog the pattern compounds: 190 breaches expose dates of birth, 261 expose phone numbers.
The practical consequences, in order of usefulness:
- Skepticism is now a security control. The scam call that knows your name, number, and address is not sophisticated; it is reading from these files. The same page shows how attackers could use your data, risk by risk (the link loads a sample address; run your own check and it shows yours), for anything your own check turns up. Treat “they knew things about me” as evidence of data access, never of authority.
- Knowledge-based verification, the security-questions layer, is dead. Mother’s maiden name, date of birth, old addresses: for a meaningful fraction of the population, strangers can answer these from public dumps.
- Passwords still matter, differently. Fewer fresh breaches leak them, but the ones already leaked were stored recoverably more than half the time, and they compound through reuse. Unique-everywhere remains the single highest-value habit.
The compilation problem: a note on AlienStealer, scrapes, and honest counting
The half’s largest addition deserves its own honesty section. The AlienStealer collection (299.6 million records, publicly known as ALIEN TXTBASE) is not a breach of one company; it is a circulated collection of infostealer-malware output, and researchers who analyzed it (SOCRadar among them) found genuine stealer-captured credentials mixed with fabricated combinations recycled from older breaches. That is why a hit in it carries a different meaning, and why our results tag it: a stealer-log hit is a signal to investigate, not proof your device was infected. Different services counted the same collection differently (one large public index counted 284 million unique email addresses; my 299.6 million is a record count); both are honest numbers describing the same messy pile, measured differently.
Similarly, LinkedInScrape-2021 (125.7 million records) is labeled a scrape: aggregated from profiles rather than exfiltrated from a database. Scraped data carries no passwords, but aggregated identity data feeds exactly the phishing and fraud patterns the data-type analysis above describes.
We label these types rather than blending them because a report that counts a padded compilation, a scrape, and a hospital breach as three identical units is inflating its own headline. The 1.02 billion figure includes all three types; this section is the asterisk, in the body where it belongs.
Part Two: What Happened Out There
Everything in Part Two is externally sourced, with a receipt per claim. Attacker-claimed figures are labeled as claims; confirmed figures name their confirmer.
The half as xonPulse tracked it
Before the deep dive, one more first-party layer. All year I curate breach news into xonPulse, a free, running feed of the stories worth knowing about. It is my editorial eye, not a census, and that is exactly what makes it measurable: it records which stories cleared the bar, week after week, as they happened.
The half in Pulse numbers:
|
Metric |
H1 2026 |
|
Stories curated |
118 |
|
Cadence |
roughly one every 36 hours (21, 20, 21, 21, 15, 20 by month) |
|
Leading sources |
BleepingComputer (64), Hackread (21), TechCrunch (19) |
|
Stories involving phishing or vishing |
12 |
|
Stories naming Salesforce-linked intrusions |
6 |
|
Stories involving healthcare |
7 |
|
Ransomware-centered stories |
11 |
Figure 6. Stories curated into xonPulse per month, and their sources, H1 2026 (n=118; source: the free xonPulse feed at api.xposedornot.com/v1/xon-pulse).
This layer adds two things. First, an independent check on the analysis: the vishing-and-Salesforce pattern that Part Two documents below (vishing is voice phishing, scam calls aimed at employees) was already visible in my own week-by-week curation, 12 phishing or vishing stories with 6 naming Salesforce, before I ever sat down to write this report. When the running feed and the retrospective agree, that is worth something. Second, stories the headline list cannot hold: Pulse’s half includes stories that never became mega-breaches but mattered to the people in them, from the European Space Agency and Nissan in January to Ericsson, Telus, and HackerOne in March, to Oxford University and Tata Electronics in June.
One honest note, same standard as everything else here: Pulse counts measure my curation, roughly twenty stories a month as capacity allows, shaped by one person’s judgment of what matters. H2 2025’s feed carried 141 items to this half’s 118; read that as my pace of curating, not a measure of how much news there was. The feed itself is public and free, so this table is as reproducible as every other first-party number in the report.
The storyline of the half: one phone call at a time
If H1 2026 has a single thread, it is that the defining breaches started with phone calls, not exploits. The extortion collective known as ShinyHunters ran a sustained vishing-and-SaaS campaign (talk an employee into access, export the CRM, extort against publication) that produced an extraordinary share of the half’s headlines (TechCrunch’s half-year roundup):
- Instructure / Canvas (May): the half’s most visible incident and the largest education-sector breach claim on record. Attackers claimed data on up to 275 million individuals across roughly 9,000 schools; Instructure reached a ransom agreement a day before the May 12 leak deadline, per reporting, and students met defaced Canvas login pages during finals week. (Wikipedia, CNN, The Hacker News) Worth saying plainly: this one is not in my index, and as far as I can tell not in anyone’s; a ransom was paid and the claimed data never surfaced. That absence is the surfaced-versus-breached distinction from the method section playing out live: the half’s biggest breach by claim is invisible to every breach-notification service, which is exactly why “I checked and I am clean” has a shelf life.
- Charter / Spectrum (May): one vishing call compromised an employee account; Salesforce data was exported; Charter refused to pay and 4.85 million unique accounts were confirmed via a public index load (the attackers claimed 42 million records, a leak-site claim). (BleepingComputer, index receipt) Charter is also in our index, at 49.3 million records, added May 28, within a month of the breach. Three numbers attach to this one incident: my 49.3 million counts exported rows, the 4.85 million confirmation counts unique email addresses, and the attackers’ 42 million was a leak-site claim. Different units, one breach; the unit matters more than the magnitude.
- Carnival (May): 5,995,277 individuals per the Maine attorney general filing, including passport and driver’s license numbers, via the same social-engineering playbook. (Maine AG)
- McGraw Hill (April): a Salesforce environment misconfiguration, then a public dump of roughly 100GB when the ransom deadline passed; 13.5 million unique emails within about 45 million records. (BleepingComputer) Also in our index (14.4 million records, added days after the dump surfaced).
- The long tail of the same campaign: ADT (via Okta vishing), Kodak (claimed 2.2 million records), DentaQuest (claimed 234GB), 7-Eleven (claimed 600,000+ Salesforce records), Match Group and Crunchbase intrusions claimed in January. All actor claims unless a company confirms. (tech.co running list, cm-alliance)
The pattern deserves stating because it inverts the popular mental model of a “hack”: no zero-days, no malware necessarily, one persuaded human, one over-permissioned SaaS integration. It is the enterprise-scale version of the lesson individuals already live with: the credential and the trusted session are the perimeter now.
The other defining stories
Conduent, and the breach total that would not stop growing (February): state attorney-general filings revised the count from roughly 4 million upward to at least 25 million confirmed (Texas 15.4M, Oregon 10.5M), with later reporting passing 62 million individuals, from a SafePay ransomware attack dating to January 2025. The half’s clearest specimen of a rule every reader should internalize: first breach numbers are floors. (TechCrunch, HIPAA Journal)
Japan’s week from hell (late June): KDDI detected unauthorized access via a vulnerability in third-party software inside KDDI’s own shared email platform serving six ISP brands, with up to 14.2 million accounts at risk and company-confirmed access to about 12.23 million email addresses and 7.61 million passwords (BleepingComputer, Japan Times). Days later, Aflac Japan disclosed 4.38 million customers and agents exposed, with bank details for about 230,000, the second major Aflac incident in roughly a year (SecurityWeek).
The 24-billion-record open database (June): researchers found a publicly exposed Elasticsearch instance holding roughly 24 billion stolen records, over 8.3TB, mostly infostealer output with plaintext passwords. Not a new breach: an aggregation of already-stolen data, sitting open. It made the stealer-log economy tangible to mainstream audiences in exactly the way our own AlienStealer indexing did at smaller scale. (Malwarebytes, Cybernews)
Stryker’s wiper attack (March): over 200,000 employee devices remotely wiped across 79 countries after compromise of a single Microsoft Intune administrator account, attributed to the Iran-linked Handala group, which claimed 50TB stolen (actor claim). The half’s most destructive incident, and its starkest reminder that one privileged account can be an entire company’s blast radius. (TechCrunch)
Nike (January): the WorldLeaks extortion group claimed to have published 1.4TB of internal design, pricing, and audit data; an IP-theft claim rather than a PII breach, and January’s biggest corporate name. Nike acknowledged an investigation without confirming scope. (Cybersecurity Magazine)
ANTS, France (April): estimates of 12 to 18 million records from the French agency holding ID and license data; treat as “up to” pending official confirmation. The half’s largest European government-sector story. (Security Boulevard)
The half in three tables
The stories above, compressed into three tables you can actually use.
Claimed versus confirmed, incident by incident. The single most useful discipline when reading breach news:
|
Incident |
Attacker claim |
Confirmed figure |
Confirmed by |
|
Instructure / Canvas |
up to 275M individuals |
not publicly confirmed |
(ransom agreement reached) |
|
Conduent |
n/a (ransomware) |
25M+ (later reporting: 62M+) |
State AG filings / HIPAA Journal |
|
Charter |
42M records |
4.85M unique emails |
public index load (receipt) |
|
Carnival |
n/a |
5,995,277 individuals |
Maine AG filing |
|
McGraw Hill |
~45M records dumped |
13,500,136 unique emails |
public index load |
|
KDDI platform |
n/a |
12.23M emails / 7.61M passwords (ceiling: up to 14.2M accounts) |
KDDI |
|
Aflac Japan |
n/a |
4.38M customers and agents |
Aflac |
|
Stryker |
50TB (actor claim) |
200,000+ devices wiped |
Operational impact reporting |
|
Kodak |
2.2M records |
not confirmed |
claim only |
|
Nike |
1.4TB internal files |
not confirmed (investigation acknowledged) |
claim only |
|
ANTS (France) |
up to 12-18M records |
pending official confirmation |
estimates only |
(Receipts for every row are linked in the incident narratives above.) The pattern: where confirmation exists, it is usually a fraction of the claim, in a different unit, or both.
The half, month by month:
|
Month |
Defining incident |
Scale (best-supported figure) |
Initial vector |
|
January |
Nike (WorldLeaks) |
1.4TB internal data (claim) |
extortion leak, vector unconfirmed |
|
February |
Conduent totals balloon |
25M+ confirmed |
ransomware (Jan 2025 intrusion) |
|
March |
Stryker wiper |
200K+ devices, 79 countries |
one compromised Intune admin account |
|
April |
McGraw Hill; ANTS |
13.5M emails; up to 18M (est.) |
Salesforce misconfig; unconfirmed |
|
May |
Instructure/Canvas; Charter leak; Carnival disclosure |
275M claim; 4.85M confirmed; 5.99M individuals |
production-system flaw; vishing to Salesforce; vishing (April intrusion) |
|
June |
KDDI; Aflac Japan; 24B open database |
12.23M emails; 4.38M; ~24B aggregated rows |
third-party software vuln; intrusion; exposed Elasticsearch |
Initial vectors across the headline incidents: vishing/social engineering to SaaS (Charter, Carnival, ADT, and the broader ShinyHunters campaign), platform or configuration flaws (Instructure, McGraw Hill, KDDI), classic ransomware intrusion (Conduent), one over-privileged admin account (Stryker), and simple exposure of an already-aggregated database (the 24B trove). Not one headline incident required an exotic exploit.
Figure 7. Initial vectors across the 10 externally reported headline incidents of H1 2026 (n=10; source: per-incident receipts, Part Two).
The actor landscape, by the numbers (all leak-site figures are claims)
The half’s ransomware economics in one table, all per Comparitech’s H1 2026 roundup:
|
Metric |
H1 2026 |
|
Ransomware attack claims (leak sites) |
4,217 (about 23 per day) |
|
Change vs H2 2025 |
up 11% (from 3,809) |
|
Victim-confirmed |
484 |
|
Claims-to-confirmed ratio |
roughly nine claims for every victim confirmation |
|
Median ransom demand |
$150,000 |
|
Average ransom demand |
$1.36 million |
|
Most-claimed country |
United States (1,832) |
Sit with that confirmation ratio: nearly nine in ten leak-site listings were unconfirmed by their alleged victims at the half’s end.
Where the claims landed, by country (all figures are leak-site claims; one tracker, Comparitech, is the only source publishing absolute per-country H1 counts, so this table deliberately stays within it):
|
Country |
H1 2026 claimed attacks |
Movement vs H2 2025 |
|
United States |
1,832 |
down 8% |
|
Canada |
200 |
up 4% |
|
Germany |
164 |
not stated |
|
United Kingdom |
157 |
not stated |
|
Italy |
131 |
up 66% |
|
France |
117 |
not stated |
|
Spain |
100 |
not stated |
|
China |
30 |
up 500% (from 5) |
Figure 8. Claimed ransomware attacks by country, H1 2026 (n=4,217 claims; source: Comparitech, single-tracker by design).
Corroboration from a second vantage: Check Point’s Q1 analysis put the US at 49.6% of that quarter’s 2,122 leak-site victims, and flagged Thailand entering the top 10 countries for the first time (Check Point Q1); its June data shows APAC’s share of reported incidents climbing from 16.8% in April to 22.6% in June (Check Point). Trackers do not reconcile exactly (different leak-site coverage, different dedup); we quote each within its own frame and never mix them in one comparison.
Quarter over quarter, the top operations (Q2 cells are reconstructed sums of Comparitech’s monthly counts, because no tracker had published a clean per-group Q2 table by July 10; all figures are claims):
|
Operation |
Q1 2026 |
Q2 2026 |
Trajectory |
|
Qilin |
353 |
280 (Apr 105 + May 97 + Jun 78) |
declining monthly; displaced from #1 in June for the first time |
|
The Gentlemen |
202 |
253 (Apr 67 + May 71 + Jun 115) |
rising; June’s leader at 115 |
|
Akira |
201 |
116 (derived: H1 317 minus Q1 201) |
declining |
|
DragonForce |
101 (Check Point; not comparable to the Comparitech-derived cells above) |
partial: 111 (Apr + May, Comparitech; June not published) |
rising per GuidePoint, which ranked it top 3 in Q2 for the first time |
(Comparitech Q1, April, May, H1; GuidePoint GRIT Q2; Check Point Q1)
The quarter’s shape in one sentence: overall claims rose (GuidePoint counted 2,279 in Q2, up 7% on Q1 and 43% year over year, across 91 active groups), while leadership churned, with Qilin fading monthly and The Gentlemen overtaking it in June. Concentration is the other trend: Check Point found the top 10 groups held 71.1% of Q1’s leak-site victims, the highest since early 2024.
Figure 9. Listed victims by operation, Q1 vs Q2 2026 (leak-site claims; sources per table; DragonForce cells not comparable across sources).
(A worked example of why we never mix tracker figures: Comparitech’s own H1 total for Qilin is 641, but its Q1 figure plus its monthly Q2 sum gives 633, because the tracker retro-updates monthly counts as listings change. Quarterly cells here stay internally consistent to their stated derivation, and the drift is the error bar leak-site data carries by nature.)
|
Operation |
H1 2026 listed victims (claims) |
Confirmed |
Note |
|
Qilin |
641 |
54 |
Most prolific of the half; overtaken monthly for the first time in June (Comparitech, Check Point Q1) |
|
The Gentlemen |
464 |
51 |
June’s leader with 115 new claims |
|
Akira |
317 |
n/a |
Third most prolific classic operation |
|
Anubis |
91 lifetime, 11 in June |
n/a |
Exploiting Citrix Bleed 2 session-token theft to bypass MFA (The Hacker News) |
And outside the leak-site model entirely, ShinyHunters, the half’s defining extortion brand as documented above, and BlackNevas, a smaller Trigona-derived operation active through June whose victim listings conflict across vendor profiles; we print no total for it because no credible one exists (SentinelOne).
Two details in that table earn emphasis. The claims-versus-confirmed gap is the actor version of “records are not people”: leak-site counts partly measure marketing. And the flaw Anubis exploits, Citrix Bleed 2, a bug in widely used corporate remote-access software, lets attackers steal session tokens and walk past MFA. It is the enterprise twin of the stealer-log session-cookie problem individuals face. The same lesson at both scales: the authenticated session is the crown jewel now.
What the industry’s own reports said
Verizon’s DBIR 2026 (May) delivered a historic shift: vulnerability exploitation overtook stolen credentials as the top initial access vector for the first time in the report’s 19 editions, and third-party involvement in breaches jumped 60%. And one finding reads like it was written for this report’s thesis: among ransomware victims that had a prior credential-leak exposure, half of those exposures occurred within the 95 days before the attack. Where exposure exists, it does not just correlate with compromise; it precedes it, closely and measurably. (Verizon DBIR, Help Net Security)
The infostealer economy went mainstream. The published numbers, with the essential caveat that these come from different vendors measuring different windows with different methods, so they must not be summed:
|
Metric |
Figure |
Source |
|
Credentials stolen via infostealers (recent 4-month window) |
1.8B+ from 5.8M infected devices (+800%) |
|
|
Compromised credentials tracked circulating in criminal markets |
2.86B |
KELA State of Cybercrime 2026 (via summary) |
|
The June open-database aggregation |
~24B rows, ~8.3TB, mostly stealer output |
|
|
Our own H1 stealer-log indexing |
299.6M records (one collection, padded; signal not verdict) |
Our half tells the same story at index scale: the largest single H1 addition was a stealer-log collection.
Regulators kept scoring points without changing the rules. The half’s enforcement scoreboard:
|
Action |
Amount |
Authority |
Receipt |
|
Free Mobile + Free (2024 breach) |
€42M combined |
CNIL (France) |
|
|
IQVIA Operations France (health data safeguards) |
€5M |
CNIL |
|
|
South Staffordshire Water |
~£1M |
ICO (UK) |
|
|
Cumulative GDPR fines, all-time |
past €7.1B |
(aggregate) |
The SEC’s four-business-day materiality-disclosure regime stayed in force with cybersecurity atop the 2026 exam agenda (overview). No landmark new disclosure rule landed in the half.
Part Three: What To Do With All of This
The report’s job is analysis; this section is the shortest because the actions have not changed, the data just keeps re-endorsing them.
If you are an individual, the whole routine fits in five steps:
- Check every email you use: xposedornot.com, ten seconds each, free.
- Triage by what leaked, not how scary it sounds (the full guide).
- Fix leaked passwords and their reuses, email and banking first.
- Turn on 2FA for email and anything holding money.
- Set a breach alert once (ours is free; any reputable service works), so the next surfacing finds you instead of the other way around.
In more detail: check every email you use, ten seconds, free. Triage by what leaked, not how scary it sounds. Fix leaked passwords and their reuses, email and banking first. Treat “they knew things about me” as data access, not authority. Then set an alert, ours or anyone’s, because this half’s 66-day median means the next surfacing will not wait for your annual checkup, and the long tail means 2019’s silence may surface next month.
If you run an organization: your employees’ credentials are likely in this half’s billion records whether or not your systems were touched; the spillover is structural. Verify your domain, free, and you see what an attacker doing recon already can; the unified dashboard puts your email exposure and your domains in one signed-in view. The DBIR’s 95-day finding turns that visibility into lead time. And this half’s defining breaches started with one persuaded human and one over-permissioned SaaS connection: your awareness session and your integration audit are suddenly the same project.
What this report cannot tell you
The caveats, in the body where they belong:
- Our window measures our index, not the world. H1’s quiet breaches are invisible to everyone, including us, until they surface; the 66-day median describes what we caught, with a survivorship bias toward the catchable. And 36 of the 101 additions were backfills of breaches that had been public elsewhere first; lag claims in this report are scoped accordingly, and any that read otherwise are errors I will correct.
- Records are not people, compilations pad, scrapes are not breaches, and our labels, while honest, are ours; another catalog’s taxonomy would shuffle mid-table rankings.
- Actor victim counts are claims, running at roughly nine claims for every victim confirmation this half.
- One catalog, one vantage point. Read this alongside the DBIR’s forensics vantage and the trackers’ leak-site vantage; the triangulation is the truth.
Appendix A: Reproduce the first-party numbers
curl -s "https://api.xposedornot.com/v1/breaches" > breaches.json
python3 - <<'EOF'
import json, collections, statistics
from datetime import datetime
d = json.load(open('breaches.json'))['exposedBreaches']
H1 = [x for x in d if '2026-01-01' <= x['addedDate'][:10] <= '2026-06-30']
tot = sum(x['exposedRecords'] for x in H1)
print("H1 additions:", len(H1), "records:", tot)
# monthly
for m in ['01','02','03','04','05','06']:
mm = [x for x in H1 if x['addedDate'][5:7] == m]
print(f"2026-{m}: {len(mm)} breaches, {sum(x['exposedRecords'] for x in mm):,} records")
# industry, both ways
ind = collections.Counter(x['industry'] for x in H1)
rec = collections.Counter()
for x in H1: rec[x['industry']] += x['exposedRecords']
print("by count:", ind.most_common())
print("by records:", rec.most_common())
# lag: median + buckets, H1 and all-time
def buckets(entries):
b = collections.Counter()
for x in entries:
g = (datetime.fromisoformat(x['addedDate']) - datetime.fromisoformat(x['breachedDate'])).days
if g < 0: continue
b['<30' if g < 30 else '30-90' if g <= 90 else '90-365' if g <= 365 else '1-3y' if g <= 1095 else '>3y'] += 1
return dict(b)
lag = sorted((datetime.fromisoformat(x['addedDate']) - datetime.fromisoformat(x['breachedDate'])).days for x in H1)
print("median lag:", statistics.median(lag), "| H1 buckets:", buckets(H1), "| all-time:", buckets(d))
# concentration + sizes
srt = sorted(H1, key=lambda x: -x['exposedRecords'])
for n in (1, 3, 10): print(f"top-{n} share: {sum(x['exposedRecords'] for x in srt[:n])/tot*100:.1f}%")
print("median size:", statistics.median(sorted(x['exposedRecords'] for x in H1)))
# data types + identity kits
dt = collections.Counter(t.strip() for x in H1 for t in x['exposedData'])
print("top data types:", dt.most_common(10))
def has(x, t): return any(s.strip() == t for s in x['exposedData']) # exact-type match
print("name+phone+address:", sum(1 for x in H1 if has(x,'Names') and has(x,'Phone numbers') and has(x,'Physical addresses')))
print("email+DOB:", sum(1 for x in H1 if has(x,'Email addresses') and has(x,'Dates of birth')))
print("phone+DOB:", sum(1 for x in H1 if has(x,'Phone numbers') and has(x,'Dates of birth')))
# size classes, top 10, verified
sizes = collections.Counter('Mega' if x['exposedRecords']>=1e8 else 'Large' if x['exposedRecords']>=1e7
else 'Medium' if x['exposedRecords']>=1e6 else 'Small' if x['exposedRecords']>=1e5 else 'Tiny' for x in H1)
print("size classes:", dict(sizes))
print("top 10:", [(x['breachID'], x['exposedRecords']) for x in srt[:10]])
print("verified:", sum(x['verified'] for x in H1), "| all-time median size:", statistics.median(sorted(x['exposedRecords'] for x in d)))
# fresh-2026 lane + YoY
F = [x for x in H1 if x['breachedDate'][:4] == '2026']
fl = sorted((datetime.fromisoformat(x['addedDate']) - datetime.fromisoformat(x['breachedDate'])).days for x in F)
print("fresh-2026:", len(F), "median lag:", statistics.median(fl), "max:", max(fl))
print("fresh-lane records:", sum(x['exposedRecords'] for x in F), "| fresh median size:", statistics.median(sorted(x['exposedRecords'] for x in F)))
print("fresh sectors:", collections.Counter(x['industry'] for x in F).most_common(4))
P = [x for x in d if '2025-01-01' <= x['addedDate'][:10] <= '2025-06-30']
print("H1-2025 additions:", len(P), sum(x['exposedRecords'] for x in P))
EOF
Appendix B: External sources
Every external claim in Part Two is linked where it appears. The primary references, in one place:
- Comparitech: H1 2026 Ransomware Roundup
- Verizon: 2026 Data Breach Investigations Report
- Check Point Research: The State of Ransomware, Q1 2026
- Flashpoint: infostealer reporting
- CNIL: enforcement notice, Free / Free Mobile
- GuidePoint GRIT Q2 2026, via Cybersecurity Dive
- Per-incident receipts: linked inline in each incident’s narrative above
Questions I expect
Where does the data come from? Publicly surfaced breach data: disclosures, dumps, collections in circulation. I verify before indexing, I do not buy data from criminals, and sensitive breaches are search-restricted. The full data policy is public, like the code.
Why is breach X not in here? Three honest possibilities: it surfaced after June 30 (this report’s window closed there), the data never publicly surfaced (the biggest claimed breach of the half is in nobody’s index, see Part Two), or I missed it, in which case tell me and the catalog inherits the fix.
Can I use these numbers and charts? Yes, and please do. Everything first-party in this report (numbers, tables, charts) is released under CC BY 4.0: reuse anything, commercially included, as long as you credit “XposedOrNot, H1 2026 Data Breach Report” and link here. If you want a number checked before you print it, ask; the reproduce-me script in Appendix A is the fastest referee.
How do I check if I am in these 101? The full list is in Appendix C. Faster: put your email into the free checker and it answers for the whole catalog, these 101 included, in about ten seconds.
Why is all of this free? Because the person in the breach is the person who most needs to know, and least likely to have a threat-intel budget. The platform is open source; the paid tier sells team plumbing, not the data.
Make the next edition better
This report ends with an invitation, not a pitch. If you hold breach data that should be indexed, know of an incident we missed, or spot an error anywhere above: email me at deva@xposedornot.com, and the H2 edition inherits the fix. Journalists: every chart and table here is free to reuse with attribution and a link; the stat sheet companion has the quotable versions, and I answer questions personally. If you build things, the entire catalog behind this report is a free, keyless API; the queries in Appendix A are a starting point, not a boundary. And if you simply want to know when your own address surfaces in H2’s data before you read about it in January’s edition: one free alert, ten seconds.
XposedOrNot is a free, open-source data breach search and notification service: 763 breaches indexed, 11.5 billion records, free alerts, free domain monitoring. The H2 edition of this report will publish in January 2027 and will extend the five-half baseline table above. Every number here is reproducible; if you find one that is not, tell me and I will fix it the same day.
Appendix C: All 101 breaches added in H1 2026
Sorted by date added. The Breached and Added columns let you recompute the lag finding from this page, and the Exposed data column lets you recompute the data-type and identity-kit findings; Appendix A has the script that does both against the live API. Breach names are our catalog IDs, which is why some run together (McGrawHill, CarnivalCorporation). Every entry is queryable by name on the free API, and browsable with filters in the public catalog.
|
Breach |
Breached |
Added |
Records |
Sector |
Exposed data |
|
CodeStepByStep |
Nov-2025 |
03-Jan-2026 |
103,502 |
Education |
Email addresses; Names; Usernames |
|
BreachForums2025 |
Oct-2025 |
11-Jan-2026 |
324,816 |
Miscellaneous |
Email addresses; Usernames; Passwords |
|
|
Jan-2026 |
12-Jan-2026 |
6,237,543 |
Entertainment |
Email addresses; Usernames; Names; Geographic locations; Phone numbers |
|
Giglio |
Aug-2025 |
26-Jan-2026 |
1,031,854 |
Retail |
Email addresses; Names; Phone numbers; Physical addresses |
|
SoundCloud |
Dec-2025 |
27-Jan-2026 |
29,968,497 |
Music |
Email addresses; Names; Geographic locations; Usernames |
|
PaneraBread |
Jan-2026 |
31-Jan-2026 |
5,119,983 |
Food |
Email addresses; Phone numbers; Names; Physical addresses |
|
Storenvy |
Apr-2019 |
01-Feb-2026 |
1,736,814 |
Retail |
Email addresses; Usernames; Passwords; IP addresses; Dates of birth; Geographic locations |
|
Betterment |
Jan-2026 |
05-Feb-2026 |
1,411,891 |
Finance |
Email addresses; Names; Phone numbers; Physical addresses; Dates of birth; Device information; Geographic locations |
|
Substack |
Oct-2025 |
07-Feb-2026 |
665,183 |
News Media |
Email addresses; Phone numbers |
|
Raaga |
Dec-2025 |
14-Feb-2026 |
10,250,072 |
Music |
Email addresses; Names; Passwords; Geographic locations; Dates of birth |
|
UnderArmour |
Nov-2025 |
14-Feb-2026 |
73,065,604 |
Retail |
Email addresses; Names; Genders; Geographic locations; Dates of birth |
|
CSDN |
Dec-2011 |
15-Feb-2026 |
6,427,771 |
Information Technology |
Email addresses; Usernames; Passwords |
|
KinoKong |
Mar-2021 |
15-Feb-2026 |
829,337 |
Entertainment |
Email addresses; Names; Usernames; Passwords; IP addresses |
|
UniversityofPennsylvania |
Oct-2025 |
17-Feb-2026 |
624,001 |
Education |
Email addresses; Names; Physical addresses; Dates of birth; Religions; Income levels |
|
CanadaGoose |
Jul-2025 |
17-Feb-2026 |
583,267 |
Retail |
Email addresses; Names; Phone numbers; Physical addresses; IP addresses; Device information |
|
LatestPilotJobs |
Aug-2022 |
18-Feb-2026 |
119,089 |
Miscellaneous |
Email addresses; Names; Usernames; Passwords |
|
BeckettCollectibles |
Nov-2025 |
18-Feb-2026 |
1,032,519 |
Retail |
Email addresses; Names; Usernames; Phone numbers; Physical addresses |
|
Utair |
Mar-2019 |
19-Feb-2026 |
402,298 |
Transport |
Email addresses; Names; Phone numbers; Dates of birth; Passport numbers; Physical addresses; Genders |
|
Cultura |
Sep-2024 |
19-Feb-2026 |
1,220,286 |
Retail |
Email addresses; Names; Physical addresses; Phone numbers |
|
CarMax |
Jan-2026 |
21-Feb-2026 |
431,646 |
Retail |
Email addresses; Phone numbers; Names; Physical addresses |
|
Fotolog |
Dec-2018 |
23-Feb-2026 |
16,720,492 |
Entertainment |
Email addresses; Usernames; Passwords |
|
CarGurus |
Feb-2026 |
23-Feb-2026 |
12,510,981 |
Retail |
Email addresses; Names; Phone numbers; Physical addresses; IP addresses |
|
MSI |
Jul-2024 |
26-Feb-2026 |
250,103 |
Electronics |
Email addresses; Names; Physical addresses; Phone numbers |
|
PassSport |
Dec-2025 |
27-Feb-2026 |
6,368,946 |
Government |
Email addresses; Phone numbers; Names; Physical addresses; Genders |
|
Odido |
Feb-2026 |
27-Feb-2026 |
6,852,322 |
Telecommunication |
Email addresses; Names; Phone numbers; Dates of birth; Bank account numbers; Physical addresses; Passport numbers |
|
VimeWorld |
Oct-2018 |
28-Feb-2026 |
3,148,075 |
Entertainment |
Email addresses; Usernames; Passwords; IP addresses |
|
TheSquare |
Jun-2025 |
28-Feb-2026 |
107,405 |
Hospitality |
Email addresses; Names; Phone numbers; Geographic locations |
|
Parapa |
Aug-2016 |
02-Mar-2026 |
4,941,171 |
Entertainment |
Email addresses; Usernames; Passwords |
|
ANPS |
Jan-2026 |
02-Mar-2026 |
5,600 |
Non-Profit/Charities |
Email addresses; Names; Dates of birth; Places of birth |
|
FigureTechnology |
Jan-2026 |
03-Mar-2026 |
995,712 |
Finance |
Email addresses; Names; Phone numbers; Physical addresses; Dates of birth |
|
SprashivaiRu |
May-2015 |
03-Mar-2026 |
3,474,588 |
Entertainment |
Email addresses; Passwords; Genders; Geographic locations; IP addresses; Dates of birth |
|
R2GamesForum |
Jan-2017 |
03-Mar-2026 |
5,189,891 |
Entertainment |
Email addresses; Usernames; Passwords |
|
BitView |
Dec-2024 |
06-Mar-2026 |
63,760 |
Entertainment |
Email addresses; Usernames; Passwords; IP addresses; Genders; Geographic locations; Dates of birth |
|
WebHostingTalk |
Jul-2016 |
06-Mar-2026 |
515,711 |
Information Technology |
Email addresses; Usernames; Passwords; IP addresses |
|
DecoratingTheHouse |
Mar-2020 |
06-Mar-2026 |
1,297,093 |
Retail |
Email addresses; Names; Usernames; Phone numbers |
|
Astropid |
Dec-2013 |
11-Mar-2026 |
11,841 |
Miscellaneous |
Usernames; IP addresses; Email addresses; Dates of birth; Instant messenger identities; Passwords |
|
ThisHabbo |
Jan-2014 |
11-Mar-2026 |
600,472 |
Entertainment |
Email addresses; Passwords; Usernames; IP addresses |
|
GameTuts |
Mar-2015 |
11-Mar-2026 |
2,246,029 |
Entertainment |
Usernames; Passwords; Email addresses; IP addresses |
|
APOIA |
Jan-2026 |
11-Mar-2026 |
452,037 |
Finance |
Email addresses; Names; Phone numbers; Physical addresses; Dates of birth |
|
CalAI |
Mar-2026 |
16-Mar-2026 |
2,830,009 |
Information Technology |
Email addresses; Genders; Dates of birth; Usernames; Social media profiles |
|
ThermomixRecipeWorldForum |
Jan-2025 |
16-Mar-2026 |
3,124,587 |
Food |
Email addresses; Names; Phone numbers; Physical addresses; Dates of birth; Usernames |
|
Aura |
Mar-2026 |
21-Mar-2026 |
922,685 |
Information Technology |
Email addresses; Names; Phone numbers; Physical addresses; IP addresses |
|
Breachforums.V5 |
Mar-2026 |
28-Mar-2026 |
340,218 |
Miscellaneous |
Email addresses; Usernames; Passwords |
|
CFGI |
Mar-2026 |
04-Apr-2026 |
250,514 |
Finance |
Email addresses; Phone numbers; Names; Physical addresses; Usernames; Geographic locations |
|
InfiniteCampus |
Mar-2026 |
04-Apr-2026 |
137,977 |
Education |
Email addresses; Phone numbers; Names; Physical addresses; Usernames; Dates of birth; Genders; Geographic locations; Passwords |
|
Success |
Mar-2026 |
04-Apr-2026 |
142,282 |
News Media |
Email addresses; Names; Phone numbers; Passwords; Device information; IP addresses; Physical addresses |
|
CutiesAI |
Mar-2026 |
05-Apr-2026 |
153,765 |
Entertainment |
Email addresses; Names |
|
SongTrivia2 |
Apr-2026 |
05-Apr-2026 |
291,815 |
Entertainment |
Email addresses; Names; Usernames; Passwords; Auth tokens |
|
BTSec |
Jan-2014 |
06-Apr-2026 |
10,404,037 |
Information Technology |
Email addresses; Passwords |
|
HumanizerPro |
Mar-2026 |
06-Apr-2026 |
65,113 |
Information Technology |
Email addresses; Names |
|
TLDRtech |
Mar-2026 |
06-Apr-2026 |
1,230,792 |
News Media |
Email addresses; Names; Usernames; Geographic locations; Social media profiles |
|
Gravatar |
Oct-2020 |
07-Apr-2026 |
25,104,710 |
Information Technology |
Names; Email addresses; Usernames |
|
MyLovelyAI |
Apr-2026 |
08-Apr-2026 |
106,544 |
Entertainment |
Email addresses; Social media profiles |
|
ParesAI |
Feb-2026 |
08-Apr-2026 |
95,190 |
Information Technology |
Email addresses; Names; Phone numbers |
|
Hallmark |
Mar-2026 |
12-Apr-2026 |
1,796,130 |
Retail |
Email addresses; Names; Phone numbers; Physical addresses |
|
KomikoAI |
Feb-2026 |
15-Apr-2026 |
1,069,679 |
Entertainment |
Email addresses; Names; AI prompts |
|
McGrawHill |
Apr-2026 |
17-Apr-2026 |
14,430,356 |
Education |
Email addresses; Names; Physical addresses; Phone numbers |
|
Amtrak |
Apr-2026 |
17-Apr-2026 |
2,206,972 |
Transport |
Email addresses; Names; Physical addresses |
|
Intersport |
Mar-2025 |
24-Apr-2026 |
2,625,398 |
Retail |
Email addresses; Names; Phone numbers; Physical addresses; Purchases |
|
CarnivalCorporation |
Apr-2026 |
24-Apr-2026 |
7,549,706 |
Hospitality |
Email addresses; Names; Genders; Dates of birth; Geographic locations |
|
RuneScapeBoards |
Aug-2013 |
27-Apr-2026 |
224,516 |
Entertainment |
Email addresses; Names; Usernames; Passwords; IP addresses |
|
ScufGaming |
Jun-2015 |
27-Apr-2026 |
129,083 |
Electronics |
Email addresses; Usernames; Names; Passwords; IP addresses |
|
ADT |
Apr-2026 |
27-Apr-2026 |
5,501,080 |
Information Technology |
Email addresses; Names; Phone numbers; Physical addresses; Partial government issued IDs |
|
Udemy |
Apr-2026 |
27-Apr-2026 |
1,402,639 |
Education |
Email addresses; Names; Phone numbers; Physical addresses; Employers; Job titles |
|
PitneyBowes |
Apr-2026 |
28-Apr-2026 |
8,315,403 |
Information Technology |
Email addresses; Names; Physical addresses; Phone numbers |
|
Gemotest |
Apr-2022 |
01-May-2026 |
6,360,145 |
Health Care |
Email addresses; Names; Dates of birth; Genders; Government issued IDs; Passport numbers; Physical addresses |
|
Baydoner |
Mar-2026 |
01-May-2026 |
1,257,021 |
Food |
Email addresses; Genders; Dates of birth; Names; Passwords |
|
MarcusMillichap |
Apr-2026 |
01-May-2026 |
1,878,051 |
Finance |
Email addresses; Names; Phone numbers; Usernames; Physical addresses |
|
AmanResorts |
Apr-2026 |
01-May-2026 |
262,340 |
Hospitality |
Email addresses; Names; Nationalities; Phone numbers; Physical addresses; Spouses names |
|
Vimeo |
Apr-2026 |
10-May-2026 |
121,476 |
Entertainment |
Email addresses; Names |
|
Abrigo |
Apr-2026 |
15-May-2026 |
779,342 |
Finance |
Email addresses; Names; Physical addresses; Phone numbers |
|
CanadaLife |
Apr-2026 |
15-May-2026 |
238,262 |
Finance |
Email addresses; Names; Physical addresses; Phone numbers |
|
LinkedInScrape-2021 |
Apr-2021 |
23-May-2026 |
125,724,601 |
Information Technology |
Email addresses; Names; Genders; Social media profiles; Job titles |
|
Kemper |
Apr-2026 |
28-May-2026 |
255,390 |
Finance |
Email addresses; Geographic locations; Names; Phone numbers; Purchases |
|
Zara |
Apr-2026 |
28-May-2026 |
256,847 |
Retail |
Email addresses; Geographic locations |
|
Charter |
May-2026 |
28-May-2026 |
49,295,990 |
Telecommunication |
Email addresses; Phone numbers; Usernames; Physical addresses; Purchases; Dates of birth; Geographic locations |
|
PeopleDataLabs |
Jan-2019 |
31-May-2026 |
179,117,119 |
Information Technology |
Email addresses; Names; Phone numbers; Geographic locations; Social media profiles |
|
Addi |
Mar-2026 |
31-May-2026 |
25,934,104 |
Finance |
Email addresses; Names; Government issued IDs; IP addresses; Phone numbers; Physical addresses; Purchases |
|
Mytheresa |
Apr-2026 |
02-Jun-2026 |
84,370 |
Retail |
Email addresses; Names; Phone numbers; Physical addresses; Partial credit card data; Purchases |
|
CushmanWakefield |
May-2026 |
02-Jun-2026 |
1,098,755 |
Finance |
Email addresses; Names; Physical addresses; Phone numbers |
|
InfinityLearn |
Aug-2024 |
03-Jun-2026 |
116,943 |
Education |
Email addresses; Names; Phone numbers; Physical addresses; Customer support tickets |
|
AtlasMenu |
May-2026 |
03-Jun-2026 |
64,085 |
Entertainment |
Email addresses; Passwords; Usernames; IP addresses; Support tickets |
|
ZenBusiness |
Mar-2026 |
05-Jun-2026 |
11,854,655 |
Finance |
Email addresses; Names; Usernames; Phone numbers; Physical addresses |
|
Ameriprise |
Mar-2026 |
05-Jun-2026 |
459,362 |
Finance |
Email addresses; Financial transactions; Job titles; Phone numbers; Names; Physical addresses |
|
7-Eleven |
Apr-2026 |
15-Jun-2026 |
281,260 |
Retail |
Email addresses; Names; Phone numbers; Physical addresses |
|
AlienStealerLogs |
Feb-2025 |
15-Jun-2026 |
299,646,818 |
Miscellaneous |
Email addresses; Passwords |
|
UniversityOfNottingham |
Jun-2026 |
16-Jun-2026 |
434,039 |
Education |
Email addresses; Names; Usernames; Phone numbers; Physical addresses; Genders; IP addresses; Ethnicities |
|
Edmunds |
Jan-2026 |
17-Jun-2026 |
191,474 |
Transport |
Email addresses; Usernames; Passwords; Phone numbers; IP addresses |
|
BakerDistributing |
May-2026 |
18-Jun-2026 |
116,353 |
Manufacturing |
Email addresses; Names; Physical addresses; Phone numbers |
|
JCPenney |
Jun-2026 |
19-Jun-2026 |
879,390 |
Retail |
Email addresses; Names; Phone numbers; Physical addresses; Genders; Dates of birth; Ethnicities |
|
BCDTravel |
May-2026 |
20-Jun-2026 |
590,182 |
Transport |
Email addresses; Names; Phone numbers; Physical addresses; Support tickets; Job titles |
|
Berkadia |
Mar-2026 |
21-Jun-2026 |
310,078 |
Finance |
Email addresses; Names; Phone numbers; Physical addresses; Employers |
|
WoFlow |
Mar-2026 |
22-Jun-2026 |
669,711 |
Information Technology |
Email addresses; Names; Usernames; Phone numbers; Physical addresses |
|
MadisonSquareGardenSports |
Jun-2026 |
23-Jun-2026 |
9,812,566 |
Sports |
Email addresses; Names; Usernames; Phone numbers |
|
CTARS |
May-2022 |
24-Jun-2026 |
67,568 |
Miscellaneous |
Usernames; Names; Email addresses; Passwords; Genders; Phone numbers; Dates of birth |
|
AmericanTower |
Jun-2026 |
25-Jun-2026 |
151,714 |
Telecommunication |
Email addresses; Names; Phone numbers; Physical addresses |
|
Albertsons |
Oct-2025 |
26-Jun-2026 |
151,753 |
Retail |
Email addresses; Names; Usernames; Phone numbers; Physical addresses; Dates of birth; Genders |
|
DentaQuest |
May-2026 |
27-Jun-2026 |
2,620,850 |
Health Care |
Email addresses; Names; Phone numbers; Genders; Dates of birth; Physical addresses; Government issued IDs |
|
RalphLauren |
Jun-2026 |
28-Jun-2026 |
142,039 |
Retail |
Email addresses; Names; Phone numbers; Genders |
|
Moody |
Jun-2026 |
29-Jun-2026 |
2,350,105 |
Education |
Email addresses; Names; Dates of birth; Physical addresses; Genders |
|
Sysco |
Jun-2026 |
30-Jun-2026 |
2,699,339 |
Food |
Email addresses; Names; Usernames; Phone numbers; Physical addresses |
