All Breaches published in the Darkweb

~ 2025

~ 2025

ohrana.ua is a Ukrainian website related to security or guard services ('okhrana' means security/guard in Russian/Ukrainian). This entry is a leaked customer database from the site, dated 2019.

A leak, originally attributed to the Russian hacker group XakNet, described as containing part of the 1C-format database of the Ukrainian payment service NovaPay (formerly Post Finance), linked to the Nova Poshta delivery company. It reportedly holds over 51,500 records of company employees' personal data, including full name, date of birth, DRFO code (tax ID/INN), gender, and email address

In February, the AI-powered comic generation platform KomikoAI suffered a data breach. The incident exposed 1M unique email addresses along with names, user posts and the AI prompts used to generate content. The exposed data enables the mapping of individual AI prompts to specific email addresses.

Data from the Venoy town hall website ( in France, reportedly obtained via SQL injection on 31 January 2026. The leaked file is a small user-account database ("MairieVenoyUtilisateur"), containing about 92 records

In June 2025, 107k unique customer email addresses were allegedly obtained from TheSqua.re, the "easiest way to find your next serviced apartment". The data also included names, phone numbers and cities which were subsequently posted to a popular hacking forum. TheSqua.re did not respond to repeated attempts to disclose the incident, however multiple impacted HIBP subscribers confirmed the legitimacy and accuracy of the data.

📁 Elledecor.com ┏• Date: 2026 ┣• Lines: 256k ┗• Size: 24 Mb 📄 Data: Name,Gender,Address,City,ZIP,Flag,Number,Gender Letter Code,Home Ownership SRC,Birth Year,Month,Day,Approximate Age,Household Income,Net Worth,Residence Type,Race Code,Racial Group,Ethnic Language,Ethnic Religion #USA

In October 2023, the Truist Bank, a leading U.S. commercial bank were breached in an cyberattack and in June 2024, the data was published on BreachForums by @ShinyHunters .The exposed data included over 79k employees unique emails (Work emails) and account balances, dates of birth, job titles, names, partial credit card data and phone numbers. The ShinyHunters themselves commented about this leak - "There is nothing less true than the promises of CrowdShart and in the case of truist the truest words to be said on this subject are when #l0ckb1tch3z! troops taking point on zscaler its #G4M30V3R for them."

8M~ records containing: significant PII, employee and customer contact information, authentication data, password hashes, portal identities, corporate account information, business leads, facilities management records, internal service tickets, and access permissions. Size: 130GB

Alert 360 Opco Inc. Over 2.5M records containing PII and other internal corporate data have been compromised. 10GB+ (compressed)

Salesforce records were compromised and other internal corporate data have been compromised. The company failed to reach an agreement with us despite all the chances and offers we made. They don't care about their clients nor investors. 15GB (compressed)

In August 2025, the French telecommunications company Bouygues Telecom detected a cyber attack against their services. The incident resulted in a data breach that exposed almost 6.4M customer records, including 5.7M unique email addresses. The breach also exposed names, physical addresses, phone numbers, dates of birth and IBANs (International Bank Account Numbers). Bouygues Telecom advised that all affected customers had been notified about the incident.

1 Million Database Phone Number Japan with Provider Records: ~1.1M

Data from the Brazilian Army's SERMIL military conscription portal (sermilweb.eb.mil.br), ~50 million records leaked in October 2025. Fields include full name, full home address, date of birth, CPF, gender, education, father's and mother's names, phone number, email, country and place of birth, army rank and blood type.

Colis Privé, a French shipping and delivery company, had its customer data scraped in November 2025 and subsequently leaked, exposing over 22 million customer records (a reply cites 22,564,381 records, noting duplicate entries for the same people). The data contained more than 12 million unique email addresses along with names, parcel numbers, phone numbers, and physical addresses.

Mon Logiciel Médical, a SaaS-based medical software platform tied to Ameli (France's national health insurance system), had patient data scraped around 2025. Over 19 million patient rows were obtained, including more than 150 thousand unique email addresses, dates of birth, genders, names, phone numbers, and physical addresses.

Easy Cash (France) Easy Cash, a French second-hand goods retailer, suffered a data breach in April 2025 that exposed over 14.6 million rows covering roughly 4.8 million clients. Replies note the file actually contains only around 5,000-5,500 unique email addresses, alongside clients, dates of birth and names.

Revora (forums.revora.net), a gaming forum, suffered a data breach that was publicly exposed in February 2025, affecting over 1.2 million users. Exposed data included email addresses, IP addresses, usernames, and passwords stored as vBulletin hashes

jamendo.com scrape Date: 2026 Records: ~6,5M

Sysco Corporation Over 61 million Salesforce records across several tables, some containing customer data/PII, employee data, and other internal corporate data was compromised.

moody.edu Over 23 gigabytes of Moody Bible Institute data (1,300+ files, tens of millions of records) was compromised across enrollment, donor relations, payroll, and communications systems (MBI, EDC/Salesforce leads, PeopleSoft PS_COMMUNICATION, Horizon SIS, WHPD donor database, and Cadence admissions), including 46 million communication records, 2.2 million enrollment lead records, 108,000 biodemographic master files with addresses and birthdates, 3.3 gigabytes of donor gift data, employee payroll XML with home addresses and earnings, 1,100+ admissions outreach files, and student housing assignment records.

Marcus & Millichap, Inc. Lesk In April 2026, the commercial real estate brokerage firm Marcus & Millichap was named as one of multiple alleged victims of the ShinyHunters hacking and extortion group. Data alleged to have been obtained from the company was subsequently released publicly and included 1.8M unique email addresses, along with names, phone numbers and employment-related information including employer, job title and physical company address. In their disclosure notice, Marcus & Millichap advised that data which may have been accessed appeared limited to "company forms, templates, marketing materials, and general contact information".

In April 2026, online training company Udemy was the victim of a “pay or leak” extortion attempt perpetrated by the ShinyHunters group. The data was subsequently leaked publicly and contained 1.4M unique email addresses belonging to customers and instructors. The data also included names, physical addresses, phone numbers, employer information and instructor payout methods including PayPal, cheque and bank transfer.

Name: Aura Date: March 2026 Records: ~900k Description: In March 2026, the online safety service Aura disclosed a data breach that exposed 900k unique email addresses. The data was primarily associated with a marketing tool from a previously acquired company, with fewer than 20k active Aura customers affected. Exposed data included names, phone numbers, physical and IP addresses, and customer service notes. Aura advised that no Social Security numbers, passwords or financial information were compromised.

Name: Fluke Date: July 2026 Records: ~800k Description: In July 2026, electronic test and measurement equipment company Fluke was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published more than 100GB of data allegedly taken from the company. The corpus contained largely corporate contact information, including over 800k unique email addresses, names, phone numbers and physical addresses. A large collection of support cases was also present.

Watiqa.ma – Moroccan Government Civil Documents Platform Date: May 2026 Format: csv Records: 695,402

Name: Crunchyroll [Fake] Date: March 2026 Records: ~6.8M Description: In March 2026, the anime streaming service Crunchyroll suffered a data breach alleged to have impacted 6.8M users. The exposed data is reported to have originated from the company's Zendesk support system where "name, login name, email address, IP address, general geographic location and the contents of the support tickets" were exposed. A subset of 1.2M email addresses from an alleged 2M record dataset being sold was later provided to HIBP.

Name: LBP-TM.FR Date: January 2026 Records: 3,691,395 Sample: {"Civilite":"MME","Nom":"D ADDETTA","Prenom":"CORALIE","Adresse1":"8 RUE BLANQUI","Adresse2":"","Numero1":"","Numero2":"0668605356","Numero3":"0664991521","Mail":"[email protected]","Code_Postal":"13530","Ville":"Trets","Code_INSEE":"13110","Pays":"1","Prenom_Enfant":"Leo","Jour_Naissance_Enfant":"06","Mois_Naissance_Enfant":"09","Annee_Naissance_enfant":"2010"}

app3.transmitenota.com.br Date: May 01, 2026 Records: 20,151,364 Format: SQL

Name: ADT Size: 10.7 GB Records: 10M+ Description: This dataset is part of a leak concerning the Council of Europe, published by the ShinyHunters group on 18 June 2026 after ransom negotiations failed, following exploitation of an Oracle PeopleSoft zero-day (CVE-2026-35273). The full leak totals roughly 295GB across ~430,000 files and reportedly includes about 409,000 pay slips for over 10,000 current and former employees (2011-2026), CVs, internal HR documents, and banking and tax information. The compromised data content is particularly sensitive: • 409,000 pay slips from over 10,000 current and former employees, covering the period 2011-2026 • 14,000 CVs and 3,700 internal HR documents • Banking information including statements and account numbers • Tax and social security data • Medical records and absence/sickness reports • Performance evaluations and payroll exports • Names, IDs, addresses, phone numbers, and dates of birth of employees

Baker Distributing Company A leak from Baker Distributing Company, attributed to the ShinyHunters group and dated 4 June 2026. It reportedly comprises over 260,000 Salesforce CRM records along with corporate data taken from various SharePoint sites

Nexstar.tv Over 1 million Salesforce records and other internal corporate data containing PII was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. 27GB+ (compressed) 1M+ Records File Size: 26.5 GB

glendale.edu In June 2026, Glendale Community College was the target of a ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from Glendale was later published online and included almost 800k unique email addresses along with various other data fields, including names, addresses, phone numbers, Social Security numbers and other information relating to student enrolments. In its disclosure notice, the college advised that "the potentially impacted information may vary for each individual and may include all or just one of the above-listed types of information".

7-Eleven, Inc. Over 600k Salesforce records containing PII and other internal corporate data have been compromised. Size: 10.4GB+ (compressed) Breach date: Apr 22 ,2026

In March 2026, the financial services firm Ameriprise Financial was named by the ShinyHunters group in a "pay or leak" extortion campaign. The group claimed possession of more than 200GB of compressed data exfiltrated from Ameriprise's Salesforce environment and internal SharePoint infrastructure, and subsequently published the data after negotiations allegedly failed. The published data contained 500k unique email addresses as well as names, phone numbers, physical addresses and employer information. In their disclosure to state attorneys general, Ameriprise reported 47,876 affected people; the larger email address population represents contacts from Ameriprise's broader operational systems, including internal staff. Ameriprise further advised that they have "implemented heightened monitoring of your account(s) to include enhanced identity verification procedures".

In June 2026, the University of Nottingham was the target of a cyber attack, later linked to a ShinyHunters "pay or leak" extortion campaign. Tens of gigabytes of data were subsequently published online and included 455k unique email addresses along with extensive personal information including names, addresses, phone numbers, ethnicities, disabilities, passport numbers and information relating to academic enrolments and fee payments. In a post about the incident, the university advised that the breach affected both "current students, and alumni".

In March 2026, the AI-driven merchant data platform Woflow was named as a victim by the ShinyHunters data extortion group. The group subsequently published tens of thousands of files allegedly obtained from the company, comprising more than 2TB of data. The trove included hundreds of thousands of email addresses, names, phone numbers and physical addresses, with the data indicating it related to Woflow customers and, in turn, the customers of merchants using their platform.

MINISTRY OF FOREIGN AFFAIRS OF VENEZUELA [FAKE] A post claiming to be a leak of Venezuela's Ministry of Foreign Affairs (mppre.gob.ve) with 1–2 million records, attributed to 'ShinyHunters' by an account later banned for impersonation and posting fake data. Forum replies state the file is truncated and that the actual content is a COVID-19 database, not Ministry of Foreign Affairs data — the leak is fake.

Cushman & Wakefield In May 2026, the real estate services firm Cushman & Wakefield was the target of a "pay or leak" extortion campaign by the ShinyHunters group. Following the threat, the group publicly published data they alleged had been obtained from the firm, consisting mostly of C&W email addresses along with tens of thousands of external email addresses and corporate contact records. The exposed data was primarily business information, including names, job titles, company addresses and phone numbers.

Berkadia In March 2026, the commercial real estate finance company Berkadia was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they alleged was taken from Berkadia's Salesforce instance, including over 300k unique email addresses as well as names, physical addresses and phone numbers, among other data.

In April 2026, the American insurance holding company Kemper Corporation was named by the ShinyHunters ransomware group in a "pay or leak" extortion campaign. According to the attackers, they gained access to Kemper's Salesforce environment through social engineering as part of a broader campaign targeting hundreds of organisations using the same method. The group later published tens of gigabytes of data that they claimed included internal directory data, Salesforce records, and Stripe payment logs. Among the 269k unique email addresses were names, phone numbers, physical addresses, and partial payment card information, including the last four digits, expiration dates, and card brands. Kemper confirmed the incident and stated that they had engaged third-party cybersecurity experts and notified law enforcement.

In June 2026, telecommunications tower infrastructure company American Tower was targeted in a ShinyHunters "pay or leak" extortion campaign. The group later published data allegedly obtained from the company, containing more than 200k unique email addresses belonging to employees, contractors, customers, and leads. The exposed data also included names, addresses, and phone numbers.

In March 2026, the financial consulting and advisory firm CFGI was the target of a ShinyHunters "pay-or-leak" extortion campaign. The group subsequently publicised data allegedly obtained from CFGI comprising corporate contact information, including 243k unique email addresses, names, phone numbers and physical addresses.

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

🔥🔥🔥🔥🔥🔥🔥🔥 💎 Buy VIP channel👑 @Hajit00n - @LegioN_LeakeRs

In April 2026, the fashion brand Zara was among a number of organisations targeted by the ShinyHunters extortion group as part of their "pay or leak" campaign. The group claimed the breach was related to a compromise of the Anodot analytics platform and subsequently published a terabyte of data allegedly including 95M support ticket records. The data contained 197k unique email addresses alongside product SKUs, order IDs and the market the support ticket originated in. Zara's parent company Inditex advised that the incident didn't affect passwords or payment information.

In June 2026, fashion retailer Ralph Lauren was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published hundreds of gigabytes of data they claimed was obtained from the organisation's Salesforce instance, including 140k unique email addresses along with names, phone numbers, genders and age groups.