{
  "api_version": 1,
  "generated": "2026-10-29",
  "documentation": "https://www.myrecon.xyz/developers.html",
  "licence": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": {
    "required": true,
    "source": "Have I Been Pwned",
    "source_url": "https://haveibeenpwned.com/",
    "distributor": "MyRecon",
    "distributor_url": "https://www.myrecon.xyz",
    "licence": "https://creativecommons.org/licenses/by/4.0/",
    "notice": "Breach data originates from Have I Been Pwned and is licensed CC BY 4.0. If you publish it you must credit Have I Been Pwned. A link to https://www.myrecon.xyz/breaches/ is appreciated but not required by the licence."
  },
  "count": 10,
  "breaches": [
    {
      "name": "AfD",
      "title": "AfD",
      "slug": "afd",
      "url": "https://www.myrecon.xyz/breaches/afd.html",
      "domain": "afd.de",
      "breach_date": "2026-09-09",
      "added_date": "2026-10-27T07:01:06Z",
      "accounts": 345439,
      "data_classes": [
        "Email addresses",
        "Email messages"
      ],
      "verified": true,
      "sensitive": true,
      "stealer_log": false,
      "logo": "https://logos.haveibeenpwned.com/AfD.png",
      "severity": 35,
      "band": "Moderate",
      "data_provider": null,
      "summary": "In September 2026, the German political party Alternative für Deutschland (AfD) suffered a data breach which exposed 345k unique email addresses. The following month, hundreds of gigabytes of data containing hundreds of thousands of emails and attachments was published online, with searchable AI-generated summaries and downloadable original files. An analysis of the incident reported that the…",
      "story": {
        "background": [
          "In September 2026, the German political party Alternative für Deutschland (AfD) suffered a data breach which exposed 345k unique email addresses. The following month, hundreds of gigabytes of data containing hundreds of thousands of emails and attachments was published online, with searchable AI-generated summaries and downloadable original files.",
          "An analysis of the incident reported that the breach was detected as early as 9 September, with a subsequent intrusion occurring five days later. In its public statement , AfD attributed the breach to an attack on a hosting provider, identified in subsequent reporting as the party-owned Alternita Dienstleistungs GmbH."
        ],
        "how": [
          "The published account does not explain the exact way the data was obtained."
        ],
        "motive": [],
        "outcome": [
          "345,439 accounts are listed in this breach. This is a count of accounts, not necessarily individual people.",
          "The reported exposed data includes Email addresses, Email messages."
        ],
        "editorial": []
      },
      "check_targets": [
        {
          "name": "AfD",
          "breach_date": "2026-09-09"
        }
      ],
      "fields": [
        {
          "name": "Email addresses",
          "why": "The address becomes a confirmed, active target, expect more phishing, better aimed."
        },
        {
          "name": "Email messages",
          "why": "Adds detail to a profile that can be assembled from several breaches at once."
        }
      ],
      "actions": [
        "Expect better-aimed phishing. A message that already knows your name and where you have an account is the whole point of a breach like this."
      ],
      "scale_line": null
    },
    {
      "name": "AssuranceRetraite",
      "title": "Assurance Retraite",
      "slug": "assuranceretraite",
      "url": "https://www.myrecon.xyz/breaches/assuranceretraite.html",
      "domain": "lassuranceretraite.fr",
      "breach_date": "2024-09-01",
      "added_date": "2026-10-20T02:29:36Z",
      "accounts": 70372,
      "data_classes": [
        "Dates of birth",
        "Email addresses",
        "Family members' names",
        "Government issued IDs",
        "Income levels",
        "Marital statuses",
        "Names",
        "Phone numbers",
        "Physical addresses"
      ],
      "verified": true,
      "sensitive": false,
      "stealer_log": false,
      "logo": "https://logos.haveibeenpwned.com/AssuranceRetraite.png",
      "severity": 53,
      "band": "Serious",
      "data_provider": null,
      "summary": "In September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries. The data included 70k unique email addresses along with names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers (NIR) and contact details of relatives or other nominated contacts. In…",
      "story": {
        "background": [
          "In September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries . The data included 70k unique email addresses along with names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers (NIR) and contact details of relatives or other nominated contacts. In its disclosure notice, Assurance Retraite attributed the breach to a compromised partner account ."
        ],
        "how": [
          "The published account does not explain the exact way the data was obtained."
        ],
        "motive": [],
        "outcome": [
          "70,372 accounts are listed in this breach. This is a count of accounts, not necessarily individual people.",
          "The reported exposed data includes Dates of birth, Email addresses, Family members' names, Government issued IDs, Income levels, Marital statuses, Names, Phone numbers, Physical addresses."
        ],
        "editorial": []
      },
      "check_targets": [
        {
          "name": "AssuranceRetraite",
          "breach_date": "2024-09-01"
        }
      ],
      "fields": [
        {
          "name": "Government issued IDs",
          "why": "Passport and licence numbers are used to prove identity to banks and telecoms, and they are effectively permanent."
        },
        {
          "name": "Physical addresses",
          "why": "Where someone actually lives. Combined with a name this moves the risk off the internet."
        },
        {
          "name": "Phone numbers",
          "why": "Enables SIM-swap attacks against SMS two-factor codes, and puts the number on scam-call lists indefinitely."
        },
        {
          "name": "Dates of birth",
          "why": "One of the three things call centres ask to verify identity, and it never changes."
        },
        {
          "name": "Names",
          "why": "Turns an anonymous address into an identified person, which is what makes targeted phishing possible."
        },
        {
          "name": "Email addresses",
          "why": "The address becomes a confirmed, active target, expect more phishing, better aimed."
        },
        {
          "name": "Family members' names",
          "why": "Adds detail to a profile that can be assembled from several breaches at once."
        },
        {
          "name": "Income levels",
          "why": "Adds detail to a profile that can be assembled from several breaches at once."
        },
        {
          "name": "Marital statuses",
          "why": "Adds detail to a profile that can be assembled from several breaches at once."
        }
      ],
      "actions": [
        "Move two-factor authentication off SMS and onto an authenticator app, which a SIM swap cannot intercept.",
        "Consider a credit freeze. A government identifier cannot be changed, so limiting what can be opened in your name is the only real control.",
        "Be sceptical of post and callers who already know your address, knowing it is no longer evidence of anything.",
        "Expect better-aimed phishing. A message that already knows your name and where you have an account is the whole point of a breach like this."
      ],
      "scale_line": null
    },
    {
      "name": "GitesDeFrance",
      "title": "Gîtes de France",
      "slug": "gitesdefrance",
      "url": "https://www.myrecon.xyz/breaches/gitesdefrance.html",
      "domain": "gites-de-france.com",
      "breach_date": "2026-05-16",
      "added_date": "2026-10-18T04:50:13Z",
      "accounts": 117574,
      "data_classes": [
        "Booking details",
        "Email addresses",
        "Names",
        "Phone numbers",
        "Physical addresses"
      ],
      "verified": true,
      "sensitive": false,
      "stealer_log": false,
      "logo": "https://logos.haveibeenpwned.com/GitesDeFrance.png",
      "severity": 49,
      "band": "Serious",
      "data_provider": null,
      "summary": "In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, including 118k unique email addresses alongside names, phone numbers, postal addresses and booking details.",
      "story": {
        "background": [
          "In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, including 118k unique email addresses alongside names, phone numbers, postal addresses and booking details."
        ],
        "how": [
          "The published account does not explain the exact way the data was obtained."
        ],
        "motive": [],
        "outcome": [
          "117,574 accounts are listed in this breach. This is a count of accounts, not necessarily individual people.",
          "The reported exposed data includes Booking details, Email addresses, Names, Phone numbers, Physical addresses."
        ],
        "editorial": []
      },
      "check_targets": [
        {
          "name": "GitesDeFrance",
          "breach_date": "2026-05-16"
        }
      ],
      "fields": [
        {
          "name": "Physical addresses",
          "why": "Where someone actually lives. Combined with a name this moves the risk off the internet."
        },
        {
          "name": "Phone numbers",
          "why": "Enables SIM-swap attacks against SMS two-factor codes, and puts the number on scam-call lists indefinitely."
        },
        {
          "name": "Names",
          "why": "Turns an anonymous address into an identified person, which is what makes targeted phishing possible."
        },
        {
          "name": "Email addresses",
          "why": "The address becomes a confirmed, active target, expect more phishing, better aimed."
        },
        {
          "name": "Booking details",
          "why": "Adds detail to a profile that can be assembled from several breaches at once."
        }
      ],
      "actions": [
        "Move two-factor authentication off SMS and onto an authenticator app, which a SIM swap cannot intercept.",
        "Be sceptical of post and callers who already know your address, knowing it is no longer evidence of anything.",
        "Expect better-aimed phishing. A message that already knows your name and where you have an account is the whole point of a breach like this."
      ],
      "scale_line": null
    },
    {
      "name": "Crunchbase",
      "title": "Crunchbase",
      "slug": "crunchbase",
      "url": "https://www.myrecon.xyz/breaches/crunchbase.html",
      "domain": "crunchbase.com",
      "breach_date": "2026-01-22",
      "added_date": "2026-10-14T06:01:26Z",
      "accounts": 559908,
      "data_classes": [
        "Email addresses",
        "Employers",
        "Job titles",
        "Names",
        "Phone numbers",
        "Physical addresses",
        "Social media profiles"
      ],
      "verified": true,
      "sensitive": false,
      "stealer_log": false,
      "logo": "https://logos.haveibeenpwned.com/Crunchbase.png",
      "severity": 57,
      "band": "Serious",
      "data_provider": null,
      "summary": "In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters \"pay or leak\" extortion attempt. Data allegedly obtained from the company was subsequently published publicly and included 560k unique email addresses, largely belonging to leads and business contacts. Other data included names, physical addresses, phone numbers, job titles, employers and LinkedIn…",
      "story": {
        "background": [
          "In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters \"pay or leak\" extortion attempt . Data allegedly obtained from the company was subsequently published publicly and included 560k unique email addresses, largely belonging to leads and business contacts. Other data included names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. Crunchbase later confirmed that a threat actor had exfiltrated documents from its corporate network."
        ],
        "how": [
          "The published account does not explain the exact way the data was obtained."
        ],
        "motive": [
          "In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters \"pay or leak\" extortion attempt ."
        ],
        "outcome": [
          "559,908 accounts are listed in this breach. This is a count of accounts, not necessarily individual people.",
          "The reported exposed data includes Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Social media profiles."
        ],
        "editorial": []
      },
      "check_targets": [
        {
          "name": "Crunchbase",
          "breach_date": "2026-01-22"
        }
      ],
      "fields": [
        {
          "name": "Physical addresses",
          "why": "Where someone actually lives. Combined with a name this moves the risk off the internet."
        },
        {
          "name": "Phone numbers",
          "why": "Enables SIM-swap attacks against SMS two-factor codes, and puts the number on scam-call lists indefinitely."
        },
        {
          "name": "Employers",
          "why": "Connects a personal account to a workplace, which is how attackers pivot from a person to a company."
        },
        {
          "name": "Names",
          "why": "Turns an anonymous address into an identified person, which is what makes targeted phishing possible."
        },
        {
          "name": "Email addresses",
          "why": "The address becomes a confirmed, active target, expect more phishing, better aimed."
        },
        {
          "name": "Job titles",
          "why": "Identifies who has access to what, which is how targets for business email compromise are picked."
        },
        {
          "name": "Social media profiles",
          "why": "Adds detail to a profile that can be assembled from several breaches at once."
        }
      ],
      "actions": [
        "Move two-factor authentication off SMS and onto an authenticator app, which a SIM swap cannot intercept.",
        "Be sceptical of post and callers who already know your address, knowing it is no longer evidence of anything.",
        "Expect better-aimed phishing. A message that already knows your name and where you have an account is the whole point of a breach like this."
      ],
      "scale_line": null
    },
    {
      "name": "Sharecare",
      "title": "Sharecare",
      "slug": "sharecare",
      "url": "https://www.myrecon.xyz/breaches/sharecare.html",
      "domain": "sharecare.com",
      "breach_date": "2026-08-12",
      "added_date": "2026-10-12T23:28:32Z",
      "accounts": 318185,
      "data_classes": [
        "Dates of birth",
        "Email addresses",
        "Employers",
        "Genders",
        "Government issued IDs",
        "Job titles",
        "Marital statuses",
        "Names",
        "Phone numbers",
        "Physical addresses"
      ],
      "verified": true,
      "sensitive": false,
      "stealer_log": false,
      "logo": "https://logos.haveibeenpwned.com/Sharecare.png",
      "severity": 59,
      "band": "Serious",
      "data_provider": null,
      "summary": "In August 2026, the digital health company Sharecare was the target of a ShinyHunters \"pay or leak\" extortion campaign. The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers. The data also…",
      "story": {
        "background": [
          "In August 2026, the digital health company Sharecare was the target of a ShinyHunters \"pay or leak\" extortion campaign . The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers.",
          "The data also included a small number of Brazilian health insurance plan members, including dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer identification numbers)."
        ],
        "how": [
          "The published account does not explain the exact way the data was obtained."
        ],
        "motive": [
          "In August 2026, the digital health company Sharecare was the target of a ShinyHunters \"pay or leak\" extortion campaign ."
        ],
        "outcome": [
          "318,185 accounts are listed in this breach. This is a count of accounts, not necessarily individual people.",
          "The reported exposed data includes Dates of birth, Email addresses, Employers, Genders, Government issued IDs, Job titles, Marital statuses, Names, Phone numbers, Physical addresses."
        ],
        "editorial": []
      },
      "check_targets": [
        {
          "name": "Sharecare",
          "breach_date": "2026-08-12"
        }
      ],
      "fields": [
        {
          "name": "Government issued IDs",
          "why": "Passport and licence numbers are used to prove identity to banks and telecoms, and they are effectively permanent."
        },
        {
          "name": "Physical addresses",
          "why": "Where someone actually lives. Combined with a name this moves the risk off the internet."
        },
        {
          "name": "Phone numbers",
          "why": "Enables SIM-swap attacks against SMS two-factor codes, and puts the number on scam-call lists indefinitely."
        },
        {
          "name": "Dates of birth",
          "why": "One of the three things call centres ask to verify identity, and it never changes."
        },
        {
          "name": "Employers",
          "why": "Connects a personal account to a workplace, which is how attackers pivot from a person to a company."
        },
        {
          "name": "Names",
          "why": "Turns an anonymous address into an identified person, which is what makes targeted phishing possible."
        },
        {
          "name": "Email addresses",
          "why": "The address becomes a confirmed, active target, expect more phishing, better aimed."
        },
        {
          "name": "Job titles",
          "why": "Identifies who has access to what, which is how targets for business email compromise are picked."
        },
        {
          "name": "Marital statuses",
          "why": "Adds detail to a profile that can be assembled from several breaches at once."
        },
        {
          "name": "Genders",
          "why": "Small on its own; useful to anyone assembling a fuller profile."
        }
      ],
      "actions": [
        "Move two-factor authentication off SMS and onto an authenticator app, which a SIM swap cannot intercept.",
        "Consider a credit freeze. A government identifier cannot be changed, so limiting what can be opened in your name is the only real control.",
        "Be sceptical of post and callers who already know your address, knowing it is no longer evidence of anything.",
        "Expect better-aimed phishing. A message that already knows your name and where you have an account is the whole point of a breach like this."
      ],
      "scale_line": null
    },
    {
      "name": "Neogen",
      "title": "Neogen",
      "slug": "neogen",
      "url": "https://www.myrecon.xyz/breaches/neogen.html",
      "domain": "neogen.com",
      "breach_date": "2026-08-29",
      "added_date": "2026-10-09T07:06:25Z",
      "accounts": 435963,
      "data_classes": [
        "Email addresses",
        "Employers",
        "Job titles",
        "Names",
        "Phone numbers",
        "Physical addresses",
        "Salutations"
      ],
      "verified": true,
      "sensitive": false,
      "stealer_log": false,
      "logo": "https://logos.haveibeenpwned.com/Neogen.png",
      "severity": 56,
      "band": "Serious",
      "data_provider": null,
      "summary": "In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters \"pay or leak\" extortion attempt. The group later published data it claimed had been obtained from Neogen. The data consisted largely of corporate contact records and included 436k unique email addresses from mailing lists, employee records and other contacts.",
      "story": {
        "background": [
          "In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters \"pay or leak\" extortion attempt . The group later published data it claimed had been obtained from Neogen. The data consisted largely of corporate contact records and included 436k unique email addresses from mailing lists, employee records and other contacts."
        ],
        "how": [
          "The published account does not explain the exact way the data was obtained."
        ],
        "motive": [
          "In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters \"pay or leak\" extortion attempt ."
        ],
        "outcome": [
          "435,963 accounts are listed in this breach. This is a count of accounts, not necessarily individual people.",
          "The reported exposed data includes Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Salutations."
        ],
        "editorial": []
      },
      "check_targets": [
        {
          "name": "Neogen",
          "breach_date": "2026-08-29"
        }
      ],
      "fields": [
        {
          "name": "Physical addresses",
          "why": "Where someone actually lives. Combined with a name this moves the risk off the internet."
        },
        {
          "name": "Phone numbers",
          "why": "Enables SIM-swap attacks against SMS two-factor codes, and puts the number on scam-call lists indefinitely."
        },
        {
          "name": "Employers",
          "why": "Connects a personal account to a workplace, which is how attackers pivot from a person to a company."
        },
        {
          "name": "Names",
          "why": "Turns an anonymous address into an identified person, which is what makes targeted phishing possible."
        },
        {
          "name": "Email addresses",
          "why": "The address becomes a confirmed, active target, expect more phishing, better aimed."
        },
        {
          "name": "Job titles",
          "why": "Identifies who has access to what, which is how targets for business email compromise are picked."
        },
        {
          "name": "Salutations",
          "why": "Adds detail to a profile that can be assembled from several breaches at once."
        }
      ],
      "actions": [
        "Move two-factor authentication off SMS and onto an authenticator app, which a SIM swap cannot intercept.",
        "Be sceptical of post and callers who already know your address, knowing it is no longer evidence of anything.",
        "Expect better-aimed phishing. A message that already knows your name and where you have an account is the whole point of a breach like this."
      ],
      "scale_line": null
    },
    {
      "name": "CyrusOne",
      "title": "CyrusOne",
      "slug": "cyrusone",
      "url": "https://www.myrecon.xyz/breaches/cyrusone.html",
      "domain": "cyrusone.com",
      "breach_date": "2026-08-05",
      "added_date": "2026-10-07T23:19:16Z",
      "accounts": 373460,
      "data_classes": [
        "Email addresses",
        "Employers",
        "Job titles",
        "Names",
        "Phone numbers",
        "Physical addresses",
        "Support tickets"
      ],
      "verified": true,
      "sensitive": false,
      "stealer_log": false,
      "logo": "https://logos.haveibeenpwned.com/CyrusOne.png",
      "severity": 55,
      "band": "Serious",
      "data_provider": null,
      "summary": "In August 2026, data centre operator CyrusOne was the target of a ShinyHunters \"pay or leak\" extortion attempt. The group subsequently published data allegedly obtained from the company, which included 373k unique email addresses across records relating to users, sales leads and CyrusOne employees. The data largely consisted of corporate contact information, including names, physical addresses…",
      "story": {
        "background": [
          "In August 2026, data centre operator CyrusOne was the target of a ShinyHunters \"pay or leak\" extortion attempt . The group subsequently published data allegedly obtained from the company, which included 373k unique email addresses across records relating to users, sales leads and CyrusOne employees. The data largely consisted of corporate contact information, including names, physical addresses, phone numbers and job titles.",
          "It also included support tickets and other information related to the organisation's operations."
        ],
        "how": [
          "The published account does not explain the exact way the data was obtained."
        ],
        "motive": [
          "In August 2026, data centre operator CyrusOne was the target of a ShinyHunters \"pay or leak\" extortion attempt ."
        ],
        "outcome": [
          "373,460 accounts are listed in this breach. This is a count of accounts, not necessarily individual people.",
          "The reported exposed data includes Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets."
        ],
        "editorial": []
      },
      "check_targets": [
        {
          "name": "CyrusOne",
          "breach_date": "2026-08-05"
        }
      ],
      "fields": [
        {
          "name": "Physical addresses",
          "why": "Where someone actually lives. Combined with a name this moves the risk off the internet."
        },
        {
          "name": "Phone numbers",
          "why": "Enables SIM-swap attacks against SMS two-factor codes, and puts the number on scam-call lists indefinitely."
        },
        {
          "name": "Employers",
          "why": "Connects a personal account to a workplace, which is how attackers pivot from a person to a company."
        },
        {
          "name": "Names",
          "why": "Turns an anonymous address into an identified person, which is what makes targeted phishing possible."
        },
        {
          "name": "Email addresses",
          "why": "The address becomes a confirmed, active target, expect more phishing, better aimed."
        },
        {
          "name": "Job titles",
          "why": "Identifies who has access to what, which is how targets for business email compromise are picked."
        },
        {
          "name": "Support tickets",
          "why": "Adds detail to a profile that can be assembled from several breaches at once."
        }
      ],
      "actions": [
        "Move two-factor authentication off SMS and onto an authenticator app, which a SIM swap cannot intercept.",
        "Be sceptical of post and callers who already know your address, knowing it is no longer evidence of anything.",
        "Expect better-aimed phishing. A message that already knows your name and where you have an account is the whole point of a breach like this."
      ],
      "scale_line": null
    },
    {
      "name": "DoubleCounter",
      "title": "Double Counter",
      "slug": "doublecounter",
      "url": "https://www.myrecon.xyz/breaches/doublecounter.html",
      "domain": "doublecounter.gg",
      "breach_date": "2026-10-04",
      "added_date": "2026-10-07T05:42:24Z",
      "accounts": 274922,
      "data_classes": [
        "Email addresses",
        "Geographic locations",
        "Names",
        "Usernames"
      ],
      "verified": true,
      "sensitive": false,
      "stealer_log": false,
      "logo": "https://logos.haveibeenpwned.com/DoubleCounter.png",
      "severity": 39,
      "band": "Moderate",
      "data_provider": null,
      "summary": "In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool. In its disclosure notice, Double Counter advised that attackers gained access to a subset of its data. A corpus of data was subsequently published publicly and contained 275k unique email addresses and Discord usernames. A small number of…",
      "story": {
        "background": [
          "In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool . In its disclosure notice, Double Counter advised that attackers gained access to a subset of its data. A corpus of data was subsequently published publicly and contained 275k unique email addresses and Discord usernames.",
          "A small number of records belonging to paying subscribers whose purchases were processed via Stripe were also present and included names, countries and postcodes."
        ],
        "how": [
          "In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool ."
        ],
        "motive": [],
        "outcome": [
          "274,922 accounts are listed in this breach. This is a count of accounts, not necessarily individual people.",
          "The reported exposed data includes Email addresses, Geographic locations, Names, Usernames."
        ],
        "editorial": []
      },
      "check_targets": [
        {
          "name": "DoubleCounter",
          "breach_date": "2026-10-04"
        }
      ],
      "fields": [
        {
          "name": "Geographic locations",
          "why": "Where the account was used, which narrows a person down further than most people expect."
        },
        {
          "name": "Names",
          "why": "Turns an anonymous address into an identified person, which is what makes targeted phishing possible."
        },
        {
          "name": "Email addresses",
          "why": "The address becomes a confirmed, active target, expect more phishing, better aimed."
        },
        {
          "name": "Usernames",
          "why": "A handle links this account to every other place the same handle is used."
        }
      ],
      "actions": [
        "Expect better-aimed phishing. A message that already knows your name and where you have an account is the whole point of a breach like this."
      ],
      "scale_line": null
    },
    {
      "name": "AngelOne",
      "title": "Angel One",
      "slug": "angelone",
      "url": "https://www.myrecon.xyz/breaches/angelone.html",
      "domain": "angelone.in",
      "breach_date": "2023-04-01",
      "added_date": "2026-10-07T03:45:31Z",
      "accounts": 6765054,
      "data_classes": [
        "Bank account numbers",
        "Dates of birth",
        "Email addresses",
        "Financial investments",
        "Government issued IDs",
        "Names",
        "Phone numbers",
        "Physical addresses"
      ],
      "verified": true,
      "sensitive": false,
      "stealer_log": false,
      "logo": "https://logos.haveibeenpwned.com/AngelOne.png",
      "severity": 70,
      "band": "Severe",
      "data_provider": "cyberbandhu.in",
      "summary": "In July 2024, the Indian stock brokerage firm Angel One confirmed that data leaked online related to a breach that occurred in April 2023. The leaked data included 7.9M user records containing 6.8M unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs) and portfolio holdings. Angel One emphasised that the breach \"has no…",
      "story": {
        "background": [
          "In July 2024, the Indian stock brokerage firm Angel One confirmed that data leaked online related to a breach that occurred in April 2023 . The leaked data included 7.9M user records containing 6.8M unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs) and portfolio holdings. Angel One emphasised that the breach \"has no impact on client securities, funds, or credentials\"."
        ],
        "how": [
          "The published account does not explain the exact way the data was obtained."
        ],
        "motive": [],
        "outcome": [
          "6,765,054 accounts are listed in this breach. This is a count of accounts, not necessarily individual people.",
          "The reported exposed data includes Bank account numbers, Dates of birth, Email addresses, Financial investments, Government issued IDs, Names, Phone numbers, Physical addresses."
        ],
        "editorial": []
      },
      "check_targets": [
        {
          "name": "AngelOne",
          "breach_date": "2023-04-01"
        }
      ],
      "fields": [
        {
          "name": "Government issued IDs",
          "why": "Passport and licence numbers are used to prove identity to banks and telecoms, and they are effectively permanent."
        },
        {
          "name": "Bank account numbers",
          "why": "Enables direct-debit fraud and gives a caller the detail needed to sound like the bank."
        },
        {
          "name": "Physical addresses",
          "why": "Where someone actually lives. Combined with a name this moves the risk off the internet."
        },
        {
          "name": "Phone numbers",
          "why": "Enables SIM-swap attacks against SMS two-factor codes, and puts the number on scam-call lists indefinitely."
        },
        {
          "name": "Dates of birth",
          "why": "One of the three things call centres ask to verify identity, and it never changes."
        },
        {
          "name": "Names",
          "why": "Turns an anonymous address into an identified person, which is what makes targeted phishing possible."
        },
        {
          "name": "Email addresses",
          "why": "The address becomes a confirmed, active target, expect more phishing, better aimed."
        },
        {
          "name": "Financial investments",
          "why": "Adds detail to a profile that can be assembled from several breaches at once."
        }
      ],
      "actions": [
        "Move two-factor authentication off SMS and onto an authenticator app, which a SIM swap cannot intercept.",
        "Check statements for the months after the breach date and ask your bank for a replacement card if the number was full.",
        "Consider a credit freeze. A government identifier cannot be changed, so limiting what can be opened in your name is the only real control.",
        "Be sceptical of post and callers who already know your address, knowing it is no longer evidence of anything.",
        "Expect better-aimed phishing. A message that already knows your name and where you have an account is the whole point of a breach like this."
      ],
      "scale_line": "That is about 25% of the population of Australia."
    },
    {
      "name": "Medela",
      "title": "Medela",
      "slug": "medela",
      "url": "https://www.myrecon.xyz/breaches/medela.html",
      "domain": "medela.com",
      "breach_date": "2026-09-07",
      "added_date": "2026-09-30T11:48:28Z",
      "accounts": 423947,
      "data_classes": [
        "Email addresses",
        "Employers",
        "Job titles",
        "Names",
        "Phone numbers",
        "Physical addresses",
        "Salutations",
        "Support tickets"
      ],
      "verified": true,
      "sensitive": true,
      "stealer_log": false,
      "logo": "https://logos.haveibeenpwned.com/Medela.png",
      "severity": 61,
      "band": "Severe",
      "data_provider": null,
      "summary": "In September 2026, Swiss medical device company Medela was the target of a ShinyHunters \"pay or leak\" extortion campaign. The data allegedly obtained in the breach was later published publicly and included 424k unique email addresses belonging predominantly to healthcare professionals, Medela staff and leads. The exposed data consisted primarily of corporate contact information, including names…",
      "story": {
        "background": [
          "In September 2026, Swiss medical device company Medela was the target of a ShinyHunters \"pay or leak\" extortion campaign . The data allegedly obtained in the breach was later published publicly and included 424k unique email addresses belonging predominantly to healthcare professionals, Medela staff and leads. The exposed data consisted primarily of corporate contact information, including names, physical addresses and phone numbers, with some records also containing associated support tickets."
        ],
        "how": [
          "The published account does not explain the exact way the data was obtained."
        ],
        "motive": [
          "In September 2026, Swiss medical device company Medela was the target of a ShinyHunters \"pay or leak\" extortion campaign ."
        ],
        "outcome": [
          "423,947 accounts are listed in this breach. This is a count of accounts, not necessarily individual people.",
          "The reported exposed data includes Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Salutations, Support tickets."
        ],
        "editorial": [
          "The distinction in this record is between professional contact information and an assumption about medical records. Have I Been Pwned's description says the addresses belonged predominantly to healthcare professionals, staff and leads. Its listed fields include employers, job titles and support tickets. That does not establish that patient histories or clinical records were exposed, and this entry should not be read as making that additional claim.",
          "Support-ticket context can make a fraudulent follow-up more convincing than a generic message. A sender may mention a product, workplace or earlier enquiry and ask the recipient to open an attachment or change payment instructions. This is a plausible risk from the listed fields, not evidence that such a campaign has been observed in this incident.",
          "Verify an unexpected request using a contact route you already know rather than the number or link inside the message. For an organization, the useful response is to identify which business addresses and support interactions are affected, inform the appropriate internal security contact, and preserve suspicious messages through the normal reporting process. Do not circulate the leaked dataset to colleagues to look for their names.",
          "A breach entry does not establish that your current account is compromised or that the affected service has reset its access controls. The source describes an extortion campaign and publication of allegedly obtained data. It does not document the exact intrusion path. Keep that unknown separate from the published contact-data description; guessing an unpatched system or stolen credential would add a causal story the available record does not support."
        ]
      },
      "check_targets": [
        {
          "name": "Medela",
          "breach_date": "2026-09-07"
        }
      ],
      "fields": [
        {
          "name": "Physical addresses",
          "why": "Where someone actually lives. Combined with a name this moves the risk off the internet."
        },
        {
          "name": "Phone numbers",
          "why": "Enables SIM-swap attacks against SMS two-factor codes, and puts the number on scam-call lists indefinitely."
        },
        {
          "name": "Employers",
          "why": "Connects a personal account to a workplace, which is how attackers pivot from a person to a company."
        },
        {
          "name": "Names",
          "why": "Turns an anonymous address into an identified person, which is what makes targeted phishing possible."
        },
        {
          "name": "Email addresses",
          "why": "The address becomes a confirmed, active target, expect more phishing, better aimed."
        },
        {
          "name": "Job titles",
          "why": "Identifies who has access to what, which is how targets for business email compromise are picked."
        },
        {
          "name": "Salutations",
          "why": "Adds detail to a profile that can be assembled from several breaches at once."
        },
        {
          "name": "Support tickets",
          "why": "Adds detail to a profile that can be assembled from several breaches at once."
        }
      ],
      "actions": [
        "Move two-factor authentication off SMS and onto an authenticator app, which a SIM swap cannot intercept.",
        "Be sceptical of post and callers who already know your address, knowing it is no longer evidence of anything.",
        "Expect better-aimed phishing. A message that already knows your name and where you have an account is the whole point of a breach like this."
      ],
      "scale_line": null
    }
  ]
}