Reference
Every data breach a public service knows about, in one searchable list: the company, the date, what kind of data was exposed, and how many accounts were in it. This is information about the world, not about you — nothing on this page looks anybody up.
Manchester Airports Group
Domain: magairports.com
Browser user agent detailsEmail addressesGeographic locationsIP addresses+4 more
Date: Aug 27, 2026
Accounts: 8,849,657
McKessonSensitive
Domain: mckesson.com
Dates of birthEmail addressesEmployersGenders+4 more
Date: Aug 21, 2026
Accounts: 6,404,340
Oz Hair and Beauty
Domain: ozhairandbeauty.com
Email addressesGeographic locationsNamesPhone numbers+1 more
Date: Aug 15, 2026
Accounts: 1,988,331
Carhartt
Domain: carhartt.com
Email addressesNamesPhone numbersPhysical addresses
Date: Aug 13, 2026
Accounts: 12,933,413
Fanlore
Domain: fanlore.org
Email addressesNamesPasswordsUsernames
Date: Aug 6, 2026
Accounts: 144,520
Chess.com (2026)
Domain: chess.com
Email addressesGeographic locationsNamesUsernames
Date: Aug 3, 2026
Accounts: 4,653,212
Alcon
Domain: alcon.com
Email addressesNamesPhone numbersPhysical addresses
Date: Aug 1, 2026
Accounts: 218,395
Questel
Domain: questel.com
Email addressesEmployersJob titlesNames+3 more
Date: Aug 1, 2026
Accounts: 1,226,209
RingCentral
Domain: ringcentral.com
Email addressesNamesPhone numbersPhysical addresses
Date: Jul 27, 2026
Accounts: 1,596,490
SplitVPN
Domain: splitvpn.io
Device informationEmail addressesGeographic locationsIP addresses+1 more
Date: Jul 21, 2026
Accounts: 865,336
Exact SciencesSensitive
Domain: exactsciences.com
Dates of birthEmail addressesGendersNames+3 more
Date: Jul 15, 2026
Accounts: 10,869,543
Brinks Home
Domain: brinkshome.com
Dates of birthEmail addressesNamesPartial credit card data+3 more
Date: Jul 13, 2026
Accounts: 732,162
Fluke
Domain: fluke.com
Email addressesEmployersJob titlesNames+2 more
Date: Jul 1, 2026
Accounts: 821,100
Inter-Con Security
Domain: icsecurity.com
Email addressesEmployersJob titlesNames+2 more
Date: Jun 18, 2026
Accounts: 276,114
Operation Endgame 4.0Malware
Domain: —
Email addressesPasswords
Date: Jun 18, 2026
Accounts: 4,348,526
Houston City College
Domain: hccs.edu
Academic recordsCitizenship statusesDates of birthEmail addresses+4 more
Date: Jun 16, 2026
Accounts: 831,642
Glendale Community College
Domain: glendale.edu
Academic recordsDates of birthEmail addressesGenders+4 more
Date: Jun 15, 2026
Accounts: 793,925
June 2026 Stealer LogsStealer logs
Domain: —
Email addressesPasswords
Date: Jun 15, 2026
Accounts: 56,278,397
Moody Bible Institute
Domain: moody.edu
Dates of birthEmail addressesGendersMarital statuses+3 more
Date: Jun 15, 2026
Accounts: 2,303,416
Sysco
Domain: sysco.com
Customer feedbackEmail addressesEmployersJob titles+4 more
Date: Jun 15, 2026
Accounts: 2,691,852
American Tower
Domain: americantower.com
Email addressesJob titlesNamesPhone numbers+1 more
Date: Jun 12, 2026
Accounts: 216,601
JCPenney
Domain: jcpenny.com
Dates of birthEmail addressesGovernment issued IDsJob titles+4 more
Date: Jun 12, 2026
Accounts: 368,418
Ralph Lauren
Domain: ralphlauren.com
Age groupsEmail addressesGendersNames+1 more
Date: Jun 11, 2026
Accounts: 139,903
Goose Creek
Domain: goosecreek.com
Email addressesNamesPhone numbersPhysical addresses+1 more
Date: Jun 9, 2026
Accounts: 6,574,121
University of Nottingham
Domain: nottingham.ac.uk
Academic recordsCitizenship statusesDates of birthDisabilities+11 more
Date: Jun 9, 2026
Accounts: 454,635
Madison Square Garden Sports
Domain: msgsports.com
Customer service recordsEmail addressesNamesPhone numbers+1 more
Date: Jun 5, 2026
Accounts: 9,796,738
Atlas Menu
Domain: atlasmenu.net
Email addressesIP addressesPasswordsSupport tickets+1 more
Date: May 30, 2026
Accounts: 63,926
BCD Travel
Domain: bcdtravel.com
Email addressesEmployersJob titlesNames+3 more
Date: May 29, 2026
Accounts: 396,313
Baker Distributing
Domain: bakerdist.com
Email addressesNamesPhone numbersPhysical addresses+1 more
Date: May 23, 2026
Accounts: 102,935
Charter
Domain: charter.com
Email addressesJob titlesNamesPhone numbers+1 more
Date: May 23, 2026
Accounts: 4,851,517
DentaQuest
Domain: dentaquest.com
Dates of birthEmail addressesGendersGovernment issued IDs+4 more
Date: May 23, 2026
Accounts: 2,553,599
Golf Canada
Domain: golfcanada.ca
Dates of birthEmail addressesGendersGeographic locations+2 more
Date: May 14, 2026
Accounts: 568,972
Cushman & Wakefield
Domain: cushmanwakefield.com
Email addressesJob titlesNamesPhone numbers+2 more
Date: May 5, 2026
Accounts: 310,431
Reborn Gaming
Domain: reborngaming.net
Email addressesIP addresses
Date: Apr 30, 2026
Accounts: 126
Vimeo
Domain: vimeo.com
Email addressesNames
Date: Apr 28, 2026
Accounts: 119,167
CTT
Domain: ctt.pt
Email addressesNamesPhone numbers
Date: Apr 26, 2026
Accounts: 468,124
Udemy
Domain: udemy.com
Email addressesEmployersJob titlesNames+3 more
Date: Apr 24, 2026
Accounts: 1,401,259
ADT
Domain: adt.com
Dates of birthEmail addressesNamesPartial government issued IDs+2 more
Date: Apr 20, 2026
Accounts: 5,488,888
Aman
Domain: aman.com
Dates of birthEmail addressesGendersLanguage preferences+6 more
Date: Apr 20, 2026
Accounts: 215,563
Canada Life
Domain: canadalife.com
Email addressesJob titlesNamesPhone numbers+3 more
Date: Apr 20, 2026
Accounts: 237,810
Snapshot taken September 16, 2026 — Have I Been Pwned · CC BY 4.0
A catalogue is the what-exists half of the picture. The other half is what an address has actually appeared in.
The data is from Have I Been Pwned, which publishes it under Creative Commons Attribution 4.0 International. That licence requires anyone showing the data to name and link the source wherever it appears — which is why the credit sits on the list itself rather than in a footer.
The catalogue and the check are two different services, and it is worth being plain about that. This list is Have I Been Pwned. Our email monitoring asks XposedOrNot about one address at a time and reports what that service answers. An address can be in this list and come back clean from a check, or be missing from it and still come back with a match.
Once, by a build script, from the source's public catalogue endpoint, and then committed. The date above is when the snapshot was taken, not when the site was last published — a page that calls itself fresh because it was redeployed is claiming something it cannot know.
Nothing is looked up here, so nothing here can leak or reveal anything: the list is the same static document for every visitor. Whether a particular address appears in breach data is answerable only by asking, and that is what the button below does.
One address, no password, no account needed.
It is one service's view, taken on the date above. Other services know about incidents this one does not, and a breach that was never publicly reported is in nobody's catalogue. The classifications are the source's, not ours: we display them, we do not audit them.
Incidents · Accounts in the data
By number of accounts, as counted by the source. The same address can appear in several.
The most frequent kinds of data across all incidents. The source names 163 kinds in total; these are the ones that turn up most.
The source classifies some incidents. The labels below are shown exactly as it defines them.
These are the source's labels and they describe the source's own rules — a sensitive incident, for example, is one it will not return for a public search. They are not limits of our own check: that asks a different service about one address, and we do not speak for another service's coverage.
Reading a catalogue is not a security measure by itself. Four things that are.
Look up the address you use today, and the ones you have stopped using but still own. An old address in a leak still matters, because the password you set on it is usually a password you reused somewhere you still log in.
A leaked password is only dangerous through reuse. Changing it on the site that leaked is the smaller half of the job; the accounts that share it are the half that catches people out.
It is the one control that survives a password becoming public. Prefer an app or a hardware key to codes sent by text message, which can be intercepted.
Changing a password does not address a leaked national ID number. Follow the advice the source publishes for that incident, and consider a fraud alert or a credit freeze rather than treating it as a login problem.