Data Breaches Database

---

N/A

N/A

N/A

N/A

N/A

source_type: news

source_type: news

On December 5th 2017, a collection of nearly 1.4 billion plaintext leaked credentials were found circulating online. The aggregate database or "combo list" found in an underground community forum has been said to be the largest ever aggregation of various leaks found in the dark web to date. The combo list was properly fragmented and sorted into two and three level directories to simplify searching for any email address, making this leak particularly dangerous.

N/A

N/A

N/A

N/A

Multiple Collections (1 to 5 + AntiPublic + Zabugor + Myrq)

N/A

NTLM

N/A

Exploit.in Combolist

Exploit.In Combolist

In January 2019, a huge collection of compromised credentials were found on the filesharing service MEGA. Labelled "Collection #1 Data Breach", this is one of the largest collections of credential stuffing lists with nearly 800 million unique email addresses. The data was sourced from hundreds of breached websites and services, many of which were already well documented in previous years. In many cases it included cracked or "dehashed" passwords that were previously hashed. Collection #1 was found widely circulated on popular hacking forums using bit torrent, and was accompanied by additional collections named 1-5 respectively.

N/A

Email addresses, Passwords

Collection #1 Collection

N/A

Dates of birth, Email addresses, Employers, Genders, Geographic locations, IP addresses, Job titles, Names, Phone numbers, Physical addresses

Verifications

Verifications.io Database

N/A

N/A

N/A

腾讯 (QQ) Database

Email addresses, Passwords

In late-August 2017, security researcher Benkow moʞuƎq discovered a spambot by the name of "Onliner Spambot". The malicious software contained a server-based component located on an IP address in the Netherlands which exposed a large number of files containing personal information. In total, there were 711 million unique email addresses, many of which were also accompanied by corresponding passwords. This breach appeared to contain data from various other breaches in the form of a somewhat incomplete "combolist".

N/A

N/A

Email addresses, Employers, Geographic locations, Job titles, Names, Phone numbers, Social media profiles

Email addresses, Passwords

In late 2016, a huge list of email address and password pairs appeared in a "combo list" referred to as "Exploit.In". The list contained ~593 million unique email addresses, many with multiple different passwords hacked from various online systems. The list was widely circulated and used for credential stuffing, that is attackers employ it in an attempt to identify other online systems where the account owner had reused their password.

N/A

N/A

Anti Public Combolist

Anti Public Combolist

Hashing Algorithm: plaintext

N/A

N/A

Facebook Scraped Data

Dates of birth, Email addresses, Employers, Genders, Geographic locations, Names, Phone numbers, Relationship statuses

Facebook Database

N/A

SHA1