Recent breaches.
And what to do.
Password, login and account breaches in the news, summarized in plain English with a practical tip for each. Last updated Nov 11, 2026.
Get Breach Watch by email.
A short weekly email with the latest password breaches and what to do, plus a same-day alert when a major breach needs quick action. Free. Unsubscribe anytime.
Showing the newest 50 of 55 breaches. Search to see older ones.
YouHack forum (via Have I Been Pwned): 7.2 million email addresses from an old hacking-forum breach added to Have I Been Pwned.
Have I Been Pwned added data from a 2013 breach of YouHack, a Russian-language hacking forum, covering about 107,000 forum members with usernames, IP addresses and weakly protected passwords. Members had also posted email-and-password pairs stolen from other people, bringing the total to 7.2 million unique email addresses.
What to do: Check your email at haveibeenpwned.com, and if it shows up, change that password anywhere you still use it.
Read on Have I Been Pwned (opens in a new tab)Microsoft Outlook: Outlook flaw used in attacks to steal Windows login data from business users.
Microsoft fixed a flaw in business versions of Outlook (Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024) that attackers were already exploiting. Opening a booby-trapped message file could make Outlook quietly connect to an attacker's server and hand over a scrambled copy of the user's Windows login (an NTLM hash) that can be cracked or reused; Microsoft has not said how many people were targeted.
What to do: Make sure Office is fully updated this month, and be careful opening message files attached to unexpected emails.
Read on Cyber Security News (opens in a new tab)SEGA: About 2.2 million newsletter email addresses leaked through an email vendor.
SEGA says ARARA, the outside company that sends its newsletters, was breached, exposing about 2.2 million subscriber email addresses, with extra details on roughly 92,000 records still being checked. SEGA says passwords, card details and SEGA Account emails were not included, and it is contacting affected customers.
What to do: Be wary of emails that look like they come from SEGA, and never click links or enter a password from an unexpected message.
Read on BleepingComputer (opens in a new tab)mSecure: mSecure warns users to change passwords after suspicious activity.
The maker of the mSecure password app emailed current and former customers about suspicious activity tied to the app and suggested they consider changing passwords, resetting two-factor codes and removing passkeys. The company has not said how many users were affected or whether any saved data was reached.
What to do: If you use or used mSecure, change the passwords for your most important accounts first, starting with email and banking, and reset their two-factor settings.
Read on The Hacker News (opens in a new tab)OpsShield (cPGuard): Fake security update hits about 2,950 web hosting servers and steals login data.
Attackers used a customer account to get into OpsShield's systems and pushed a malicious cPGuard update that ran on about 2,950 Linux hosting servers for roughly 70 minutes, collecting password hashes, SSH keys and database passwords. Around 7,900 billing accounts, including hashed passwords, were also taken; the company has released a clean update and told customers to reset their credentials.
What to do: If your website host or IT provider uses cPGuard, ask them to confirm the update was applied and change your hosting, database and email passwords.
Read on OpsShield (opens in a new tab)Sony Network Communications (So-net / plala): 2.58 million customer records exposed, including 54,401 email passwords.
The Sony-owned Japanese internet provider says an attacker accessed its member database on October 19, exposing names, phone numbers, email addresses, user IDs and dates of birth for 2,585,481 current and former So-net and plala members. Passwords for 54,401 email accounts were also exposed and were reset on October 27; member account passwords and credit card details were not affected.
What to do: If you use So-net or plala, set a new email password, change it anywhere else you reused it, and ignore messages about the breach that ask you to click a link.
Read on Impress Watch (opens in a new tab)DreamHost: Email and FTP/SFTP passwords reset during an unexplained incident.
During an incident that began on October 23 and took its web File Manager offline, DreamHost expired the passwords of some email and FTP/SFTP users as a precaution, and is asking account owners to change every email and FTP/SFTP password. DreamHost hasn't said whether any credentials were accessed and is still investigating the cause.
What to do: If you host with DreamHost, change every mailbox and FTP/SFTP password, remove any email forwarding you don't recognize, and change the old passwords anywhere you reused them.
Read on webhosting.today (opens in a new tab)Fortinet and Palo Alto Networks firewalls: Hacking group exposes more than 70,000 credentials from company firewalls and VPNs.
Group-IB and NyxLab say a group called k0t broke into exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect devices using known flaws or common passwords, then moved through company networks. More than 70,000 exposed credentials are tied to the campaign, and many victims later appeared on ransomware leak sites.
What to do: IT teams should patch firewalls and VPNs, replace any default or common passwords on them, and reset credentials for devices that were exposed to the internet.
Read on The Hacker News (opens in a new tab)Capcom: 11.7 million CAPCOM ID records accessed.
Capcom says an intruder accessed 11,774,247 CAPCOM ID records containing email addresses and account details such as last login date and IP address, and changed the passwords of 196 accounts. Credit card information was not affected.
What to do: Treat any email that claims to be from Capcom with suspicion, and change your Capcom password anywhere you reused it.
Read on Capcom (opens in a new tab)GMO Internet (Onamae.com Desktop Cloud): Malware installed on up to 26,739 customer cloud servers.
GMO Internet says attackers installed unauthorized programs in customer servers of its Japanese Onamae.com Desktop Cloud service, and it shut the servers down. Data stored on the affected servers, including any saved passwords, may have been exposed; payment card details are kept separately and are reportedly not affected.
What to do: If you used Onamae.com Desktop Cloud, change any passwords you saved or used on that server, and ignore emails or calls asking for your password or card details.
Read on BleepingComputer (opens in a new tab)TeamUpdraft (UpdraftPlus): Stolen keys used to backdoor WordPress sites after a customer database breach.
TeamUpdraft says an attacker likely accessed its customer database, including password hashes, two-factor settings and UpdraftCentral connection keys, on October 17–18. Security firm Patchstack reports the stolen keys were then used to add administrator accounts and backdoor plugins to WordPress sites.
What to do: WordPress site owners using UpdraftPlus should update the plugin, delete UpdraftCentral connection keys, check for unknown admin accounts, and change their TeamUpdraft password.
Read on BleepingComputer (opens in a new tab)ConnectWise Cloud Backup: Stolen app credentials open Microsoft 365 accounts at 160+ organizations.
Attackers signed in to customers' Microsoft 365 environments as ConnectWise's own backup app, so two-factor sign-in didn't apply. Security firm Huntress found at least 162 affected organizations, and ConnectWise took the service offline.
What to do: IT providers using ConnectWise Cloud Backup should disable the app, remove recently added app secrets, and review Microsoft 365 app sign-ins.
Read on BleepingComputer (opens in a new tab)SourceNext: Up to 22.5 million customer records, including passwords.
Japanese software company SourceNext says a third party pulled customer data through its member-information system. Records may include email addresses, passwords, names, addresses and phone numbers. All passwords have been reset.
What to do: If you have a SourceNext account, change that password everywhere else you used it, and watch for fake SourceNext emails and texts.
Read on SourceNext (opens in a new tab)Domino's: Customer accounts taken over with reused passwords.
Domino's says its systems were not breached. Attackers logged in to a small number of customer accounts using email and password pairs stolen from other websites, a technique called credential stuffing.
What to do: Never reuse a password. One leak elsewhere is all it takes for attackers to try it on every site you use.
Read on Malwarebytes (opens in a new tab)Gyazo: 23.6 million user records, including password hashes, stolen.
Gyazo's owner Helpfeel said an attacker exploited a flaw in the image upload server on September 11 and took about 23.62 million user records, including email addresses, password hashes, session IDs and X integration tokens. Payment card data was not affected.
What to do: Change your Gyazo password, and change it anywhere you used the same or a similar one.
Read on Security Affairs (opens in a new tab)TELUS: Customer accounts accessed with stolen logins over 16 months.
TELUS is notifying consumer customers whose accounts were accessed with compromised login details between February 2025 and June 2026. Attackers saw names, account and phone numbers, addresses, emails, partial card numbers and payment history, and used them to pressure customers to switch providers.
What to do: If you're a TELUS customer, use an account password you don't use anywhere else, and be suspicious of calls urging you to switch providers.
Read on SecurityWeek (opens in a new tab)Sakura Internet: Data of up to 1.36 million member accounts may be exposed.
Japanese cloud provider Sakura Internet said hackers got into its sales management system on August 9, which holds customer contract and membership details and hashed passwords. Up to 1,360,563 accounts may be affected; no card data is stored there and no data theft has been confirmed.
What to do: If you have a Sakura Internet account, change that password and any other account where you used the same one.
Read on BleepingComputer (opens in a new tab)Google Chrome: Malware can hijack passkeys synced by Chrome's password manager.
Palo Alto Networks' Unit 42 showed how malware on a Windows PC can abuse Google Password Manager in Chrome to take over accounts and steal the master key protecting synced passkeys.
What to do: Keep your computer and browser up to date, and be careful what you install.
Read on BleepingComputer (opens in a new tab)Chick-fil-A: Rewards accounts hijacked with passwords stolen elsewhere.
Chick-fil-A said attackers used email and password pairs from a third-party source to get into Chick-fil-A One accounts from June 17 to 19, 2026. Names, emails, membership and mobile pay numbers, credit balances and the last four digits of saved cards were exposed; affected accounts were logged out and balances restored.
What to do: Give your Chick-fil-A One account a password you don't use anywhere else.
Read on BleepingComputer (opens in a new tab)KDDI: Email logins of up to 14.22 million accounts at six Japanese providers exposed.
KDDI said attackers exploited a flaw in third-party software on an email system used by KDDI and five other providers, exposing email addresses and passwords; some passwords were hashed or encrypted. Up to 14.22 million current, former and inactive accounts may be affected.
What to do: If your email is with KDDI, BIGLOBE, NIFTY, JCOM, STNet or Chubu Telecommunications, reset that password now and anywhere you reused it.
Read on BleepingComputer (opens in a new tab)LastPass: Customer contact details exposed through a vendor; vaults not affected.
LastPass said an attacker stole OAuth tokens from Klue, a third-party vendor, and used them to reach LastPass customer names, emails, phone numbers, addresses and support case details in Salesforce. LastPass said customer vaults remained secure.
What to do: Be wary of calls or emails claiming to be from LastPass, and never share your master password.
Read on BleepingComputer (opens in a new tab)Exposed malware log database: 24 billion stolen login records found in one open database.
Cybernews researchers found an unprotected database of more than 8.3 TB with 24 billion credential records from 36 sources, including logs from password-stealing malware with plain-text passwords. It was taken offline quickly, so duplicates and whose data it held couldn't be determined.
What to do: Change any password you've reused, starting with email, banking and shopping, and turn on two-step sign-in.
Read on Malwarebytes (opens in a new tab)Dashlane: Hackers stole about 20 customers' encrypted password vaults.
Dashlane said hackers brute-forced two-step sign-in codes to add new devices to about 20 customer accounts and download their encrypted vaults. The vaults can't be read without each customer's master password, and Dashlane said its own systems weren't compromised.
What to do: If you use Dashlane, make sure your master password is long and unique, and review the devices connected to your account.
Read on TechCrunch (opens in a new tab)Unprotected login database: 149 million usernames and passwords left exposed online.
Researcher Jeremiah Fowler found an unprotected database with 149,404,754 unique logins, including an estimated 48 million Gmail, 17 million Facebook and 3.4 million Netflix accounts. It was not a breach of those companies; the data appears to come from past breaches and password-stealing malware.
What to do: Change passwords you've reused, scan your computer for malware, and turn on two-step sign-in.
Read on Fox News (opens in a new tab)Bitwarden, LastPass, Dashlane: Study uncovers 25 recovery attacks in major cloud password managers.
ETH Zurich researchers found 25 attacks by which someone controlling a vendor's servers could, in some cases, expose passwords stored in Bitwarden, LastPass and Dashlane vaults.
What to do: Keep your password manager updated and use a long, unique master password.
Read on The Hacker News (opens in a new tab)LastPass: Vaults stolen in 2022 still enabling cryptocurrency theft.
Blockchain analysts at TRM Labs traced about $35 million in cryptocurrency stolen by cracking LastPass vaults taken in the 2022 breach, with thefts continuing more than three years later.
What to do: If your vault was ever exposed, change the passwords and move any crypto keys that were stored in it.
Read on TechRadar (opens in a new tab)Synthient login lists: Nearly 2 billion email addresses and 1.3 billion passwords added to Have I Been Pwned.
Have I Been Pwned added almost 2 billion unique email addresses and 1.3 billion unique passwords, 625 million of them never seen before, from credential stuffing lists gathered by Synthient. Subscribers confirmed some of the listed passwords were real, and some were still in use.
What to do: Check haveibeenpwned.com, change any password that appears there, and stop reusing passwords.
Read on CyberInsider (opens in a new tab)Synthient stealer logs: 183 million email addresses and passwords added to Have I Been Pwned.
Have I Been Pwned added 183 million unique email addresses, each tied to a website and password, from 3.5 TB of malware logs collected by Synthient; 16.4 million were new to the service. It was not a Gmail breach; the logins were stolen from infected devices.
What to do: Check haveibeenpwned.com and change any exposed password everywhere you used it.
Read on CyberInsider (opens in a new tab)Plex: Users told to reset passwords after hashed passwords were stolen.
Plex said an attacker accessed a database with email addresses, usernames, securely hashed passwords and authentication data. No payment card data was included, and Plex asked users to reset their passwords.
What to do: Reset your Plex password with "sign out connected devices" checked, turn on two-step sign-in, and change the password anywhere you reused it.
Read on BleepingComputer (opens in a new tab)Salesloft Drift: Stolen app tokens used to search company Salesforce data for passwords and keys.
Hackers stole OAuth tokens for Salesloft's Drift chat integration and used them from August 8 to 18 to pull data from customers' Salesforce systems, searching it for passwords, AWS keys and other secrets. Salesloft revoked all Drift tokens.
What to do: For IT teams: reconnect third-party app integrations with new tokens and rotate any passwords or keys stored in support tickets or CRM records.
Read on BleepingComputer (opens in a new tab)Password manager extensions: Clickjacking trick could make browser extensions fill in logins for attackers.
A researcher showed that hidden forms on a malicious page could trick 11 password manager browser extensions, including 1Password, Bitwarden, LastPass and iCloud Passwords, into filling in logins, two-factor codes or card details with one click. Some vendors had released fixes at disclosure; others had not.
What to do: Keep password manager extensions updated, and consider turning off automatic autofill so logins are filled only when you choose.
Read on The Hacker News (opens in a new tab)McDonald's McHire: Password "123456" exposed 64 million job applications.
Researchers signed in to a test admin account for McDonald's McHire hiring chatbot, run by Paradox.ai, using 123456 as both username and password. With a second flaw, they could see more than 64 million job applications with names, emails, phone numbers and home addresses; it was fixed the day it was reported.
What to do: If you applied for a McDonald's job through McHire, watch for fake job offers that ask for money or bank details.
Read on BleepingComputer (opens in a new tab)Exposed login datasets: About 16 billion login records briefly left open online.
Cybernews researchers found 30 briefly exposed datasets holding about 16 billion records of website addresses, logins and passwords, mostly collected by password-stealing malware. Many records are duplicates or old, so the number of unique accounts is unclear.
What to do: Change any password you've used on more than one site, and turn on two-step sign-in for email and banking.
Read on Security Affairs (opens in a new tab)The North Face: Customer accounts accessed with passwords stolen elsewhere.
The North Face said attackers used stolen email and password pairs in a small credential stuffing attack on April 23, 2025. They may have seen names, emails, shipping addresses, purchase history and, if saved, birth dates and phone numbers; payment cards are not stored on the site.
What to do: If you haven't changed your North Face password since April 2025, change it to one you don't use anywhere else.
Read on Malwarebytes (opens in a new tab)Unprotected login database: 184 million usernames and passwords found online.
Researcher Jeremiah Fowler found an unprotected database with about 184 million plain-text usernames and passwords for services including Apple, Google, Microsoft, Facebook, banks and government portals. It was likely collected by password-stealing malware.
What to do: Change passwords you've reused, starting with email and banking, and turn on two-step sign-in.
Read on Security Boulevard (opens in a new tab)Lumma Stealer: Password-stealing malware disrupted after infecting 394,000 computers.
Microsoft and law enforcement partners seized about 2,300 domains used by Lumma, malware that steals saved passwords, cookies, credit cards and crypto wallets from web browsers. Microsoft found more than 394,000 infected Windows computers in two months.
What to do: Keep your antivirus on and updated and avoid pirated software; if you suspect malware, clean your computer, then change your passwords.
Read on BleepingComputer (opens in a new tab)KeePass (fake installer): Fake password manager installer stole users' password databases.
WithSecure found that Bing ads led people to fake sites offering a modified version of the KeePass password manager. It worked normally but exported the password database in plain text to the attackers and installed tools that led to a ransomware attack.
What to do: Download password managers and other software only from the official website, never from search ads.
Read on BleepingComputer (opens in a new tab)Oracle Cloud: Old login data with hashed passwords stolen from a legacy system.
Oracle privately told customers that attackers stole old client credentials, including usernames, emails and hashed passwords, from a legacy environment. A hacker had offered 6 million records from Oracle's cloud sign-in servers for sale; Oracle publicly denied an Oracle Cloud breach.
What to do: For IT teams using Oracle Cloud: reset passwords for affected accounts and rotate keys and secrets tied to single sign-on.
Read on BleepingComputer (opens in a new tab)ALIEN TXTBASE logs: 284 million accounts stolen by password-stealing malware.
Have I Been Pwned added 284 million email addresses from 1.5 TB of malware logs shared in a Telegram channel called ALIEN TXTBASE, plus 244 million passwords it hadn't seen before. Each log pairs a website with the email and password someone used there.
What to do: Check haveibeenpwned.com, change any exposed password everywhere you used it, and scan your computer for malware.
Read on BleepingComputer (opens in a new tab)PowerSchool: One stolen login exposed student and teacher records.
A hacker used compromised credentials for PowerSchool's customer support portal to export student and teacher data from school systems in the U.S. and Canada. Names, contact details, Social Security numbers, medical alerts and grades were included for some people.
What to do: If your school notified you, accept the free credit or identity monitoring offered, and consider freezing your child's credit.
Read on CyberInsider (opens in a new tab)Okta: Flaw let some accounts sign in with any password.
Okta fixed a bug in its AD/LDAP Delegated Authentication where a username of 52 or more characters could be accepted with any password under certain conditions, such as a cached login with multi-factor sign-in turned off. The issue existed from July 23 to October 30, 2024.
What to do: For IT teams using Okta: check logs for long-username sign-ins in that period and require multi-factor sign-in for every user.
Read on The Register (opens in a new tab)Internet Archive: 31 million user accounts and password hashes stolen.
Hackers breached the Internet Archive and took a database of about 31 million users' email addresses, screen names and bcrypt password hashes. The data was added to Have I Been Pwned.
What to do: If you haven't changed your Internet Archive password since October 2024, change it now, along with any other account where you used the same one.
Read on Help Net Security (opens in a new tab)Transport for London: 30,000 staff passwords reset in person after a cyberattack.
Transport for London said all 30,000 employees must verify their identity and reset their passwords in person after a cyberattack. Oyster card refund data, including bank account numbers and sort codes for about 5,000 customers, may have been accessed.
What to do: If TfL contacted you about refund data, watch your bank account and be wary of calls or emails asking for more details.
Read on The Register (opens in a new tab)Trello: 15 million user email addresses offered for about $2.
A hacker matched more than 15 million email addresses to Trello accounts in January 2024 through an open Trello API, then offered the list with names and public profile details on a hacking forum in July. No passwords were included.
What to do: Be wary of emails that claim to be from Trello or Atlassian and ask you to sign in.
Read on TechRadar (opens in a new tab)RockYou2024: Almost 10 billion passwords posted in one file.
A file named rockyou2024.txt with 9,948,575,739 unique plain-text passwords was posted on a hacking forum on July 4. Cybernews researchers say it mixes old and new breaches collected over about 20 years.
What to do: Assume any password you've reused could be in lists like this; change reused passwords, starting with email and banking.
Read on Security Affairs (opens in a new tab)Twilio Authy: Phone numbers of two-factor app users exposed through an unsecured endpoint.
Twilio said attackers identified data linked to Authy accounts, including phone numbers, through an unauthenticated endpoint that it has since secured. A hacker claimed 33 million numbers; Twilio did not confirm that figure.
What to do: Update the Authy app and be wary of texts or calls claiming to be from Authy or Twilio.
Read on TechCrunch (opens in a new tab)Snowflake customers: Stolen passwords without two-step sign-in led to data theft at about 165 companies.
Mandiant found attackers signed in to Snowflake customers' accounts with passwords stolen by malware, some dating back to 2020, on accounts without multi-factor authentication. About 165 organizations were affected; earlier reports named Ticketmaster and Santander among potential victims.
What to do: If a company you use says it was affected, change your password there and watch for scam emails that use your details.
Read on SecurityWeek (opens in a new tab)Telegram login lists: 361 million email addresses found in stolen login lists.
Have I Been Pwned added 361 million email addresses from login lists shared in Telegram channels; 151 million had never appeared in its database before. Some files paired email addresses with passwords and the website they were used on, likely from earlier breaches and password-stealing malware.
What to do: Check your email address at haveibeenpwned.com and change any password you've used on more than one site.
Read on Help Net Security (opens in a new tab)Dropbox Sign: Hashed passwords, API keys and two-step sign-in data stolen.
Dropbox said attackers broke into Dropbox Sign's production systems and accessed emails, usernames, phone numbers, hashed passwords and authentication data such as API keys, OAuth tokens and multi-factor settings. Dropbox reset all users' passwords and logged everyone out.
What to do: If you use Dropbox Sign, make sure you've set a new password and re-added it to your authenticator app, and change the old password anywhere you reused it.
Read on BleepingComputer (opens in a new tab)Change Healthcare: Stolen login opened a remote-access portal with no two-step sign-in.
UnitedHealth's CEO said hackers used stolen login credentials to get into a Change Healthcare remote-access portal that did not have multi-factor authentication. The ransomware attack exposed health data on what UnitedHealth called a substantial proportion of people in America.
What to do: If you get a breach letter from Change Healthcare, sign up for the free monitoring it offers and check medical bills and insurance statements for services you didn't receive.
Read on TechCrunch (opens in a new tab)
Get Breach Watch by email.
A short weekly email with the latest password breaches and what to do, plus a same-day alert when a major breach needs quick action. Free. Unsubscribe anytime.
Passwords that are never stored can't be stolen.
WordCrypt creates each site's password when you need it, so there's no vault to steal.
Have a breach tip or a correction? Contact us.
Breach Watch summarizes publicly available news reports and company notices, with a link to each source. Details may change as investigations continue; always check the original source. WordCrypt is not affiliated with the companies or publications mentioned, and their names and trademarks belong to their owners. This page is for general information only and is not legal or security advice.