1,042 publicly known breaches covering about 18B exposed records and 163 different types of personal data. Search by company, year or the kind of data that was taken.
By unique accounts in this directory, Synthient Credential Stuffing Threat Data is the largest at about 2.0B accounts, recorded with a breach date of 2025-04-11. Aggregated credential collections can be larger still because they combine many earlier breaches.
Run the free email breach check. It matches your address against these datasets and shows which breaches list it and exactly what each one exposed.
A breach means someone broke in and took data. A leak usually means the data was left exposed by mistake, for example an unsecured database or a misconfigured storage bucket. The consequences for you are the same once the data is circulating.
Sensitive means the breach could reveal something damaging, such as an adult site or a political affiliation, so it is not publicly searchable. A spam list is a marketing database rather than a hacked service, so it usually contains no passwords.
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.