Have I Been Pwned

New breach: Aura exposed 900k unique email address earlier this month, primarily sourced from a marketing tool. Data also included name, phone number, physical and IP address. 90% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/Aura

New breach: League of Legends custom skins service Divine Skins had 105k email addresses and usernames breached this week, along with user purchase history. 50% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/DivineSkins

New breach: Turkish restaurant chain Baydöner had 1.2M unique email addresses exposed last week. Data also included name, phone number, city and plaintext password. 28% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/Baydoner

New breach: Recipe service Provecho allegedly had 713k unique email addresses obtained earlier this month. Data also included username and the creators accounts followed. 73% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/Provecho

New breach: Relationship app Lovora allegedly exposed 496k unique email addresses last month. Data also included display name, photo and other personal info. The developer did not respond to contact attempts. 12% were already in @haveibeenpwned@infosec.exchange. More: https://haveibeenpwned.com/Breach/Lovora

New sensitive breach: Porn addiction app Quitbro allegedly exposed 23k unique email addresses last month. Data also included year of birth and last relapse time. The developer did not respond when contacted. 22% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/Quitbro

New breach: AI-powered comic generation platform KomikoAI suffered a breach last week that exposed 1M unique email addresses. Data included AI prompts and their mapping back to email addresses. 22% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/KomikoAI

New breach: Canadian Tire had 38M unique email addresses breached in October. Data also included name, phone, physical address, PBKDF2 password and partial credit card data. 86% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/CanadianTire

New breach: CarGurus had more than 12M unique email addresses exposed in a breach earlier this month. Data also included names, phone numbers and physical and IP addresses. 70% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/CarGurus

New breach: Fintech lending platform Figure had over 900k unique email addresses breached and posted publicly last week. Data included name, phone, DoB and physical address. 79% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/Figure

New breach: Data allegedly relating to Canada Goose customers was published online this week including 582k unique email addresses with name, phone number and partial credit card data (type and last 4 digits). 79% were already in @haveibeenpwned@infosec.exchange. More: https://haveibeenpwned.com/Breach/CanadaGoose

New breach: The University of Pennsylvania suffered a breach in October which was then published publicly earlier this month. Data included 624k unique email addresses among other personal attributes. 78% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/UniversityOfPennsylvania

New breach: Brazilian crowdfunding platform APOIA[.]se was breached in December 2025. Impacted data included 451k unique email addresses, along with names and physical addresses. 79% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/APOIAse

New breach: Gaming community Toy Battles had 1k unique email addresses breached last week. Data also included usernames, IP addresses and chat logs. 49% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/ToyBattles

New breach: French non-profit Association Nationale des Premiers Secours (ANPS) had 5.6k unique email addresses exposed last month. Data also included names, dates of birth and places of birth. 69% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/ANPS

New breach: Substack had 663k records compromised in October and published online this week. Data included email address, phone number and associated public account info. 53% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/Substack

New breach: Betterment suffered a data breach last month exposing 1.4M unique email addresses. Following the incident, customers received crypto-related scam messages. 75% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/Betterment

New breach: Panera Bread was extorted earlier this month before having 5.1M unique email addresses dumped publicly this week. Data also included name, phone and physical address. 77% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/PaneraBread

New breach: SoundCloud had 30M email addresses mapped to public profile data last month including name, username, follower count and in some cases, country. 67% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/SoundCloud

New breach: Under Armour was the victim of a ransomware attack in November. Customer data was published to a hacking forum this week and includes 72M email addresses, along with other personal information. 76% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/UnderArmour

New breach: Indian streaming music service Raaga allegedly had 10M records breached last month. Data included email, name, gender, age, postcode and unsalted MD5 password hash. 60% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/Raaga

New breach: France's Pass'Sport had 6.5M email addresses breached and posted publicly last month. Data included name, phone, gender and physical address. 71% were already in @haveibeenpwned@infosec.exchange. Read more: https://haveibeenpwned.com/Breach/PassSport