New breach: France's Pass'Sport had 6.5M email addresses breached and posted publicly last month. Data included name, phone, gender and physical address. 71% were already in Have I Been Pwned. Read more: haveibeenpwned.com/Breach/PassSpo…

New breach: Indian streaming music service Raaga allegedly had 10M records breached last month. Data included email, name, gender, age, postcode and unsalted MD5 password hash. 60% were already in Have I Been Pwned. Read more: haveibeenpwned.com/Breach/Raaga

New breach: Under Armour was the victim of a ransomware attack in November. Customer data was published to a hacking forum this week and includes 72M email addresses, along with other personal information. 76% were already in Have I Been Pwned. Read more: haveibeenpwned.com/Breach/UnderAr…

New breach: SoundCloud had 30M email addresses mapped to public profile data last month including name, username, follower count and in some cases, country. 67% were already in Have I Been Pwned. Read more: haveibeenpwned.com/Breach/SoundCl…

New breach: Panera Bread was extorted earlier this month before having 5.1M unique email addresses dumped publicly this week. Data also included name, phone and physical address. 77% were already in Have I Been Pwned. Read more: haveibeenpwned.com/Breach/PaneraB…

New breach: Betterment suffered a data breach last month exposing 1.4M unique email addresses. Following the incident, customers received crypto-related scam messages. 75% were already in Have I Been Pwned. Read more: haveibeenpwned.com/Breach/Betterm…

New breach: Substack had 663k records compromised in October and published online this week. Data included email address, phone number and associated public account info. 53% were already in Have I Been Pwned. Read more: haveibeenpwned.com/Breach/Substack

New breach: Gaming community Toy Battles had 1k unique email addresses breached last week. Data also included usernames, IP addresses and chat logs. 49% were already in Have I Been Pwned. Read more: haveibeenpwned.com/Breach/ToyBatt…

New breach: Brazilian crowdfunding platform APOIA[.]se was breached in December 2025. Impacted data included 451k unique email addresses, along with names and physical addresses. 79% were already in Have I Been Pwned. Read more: haveibeenpwned.com/Breach/APOIAse

New breach: Data allegedly relating to Canada Goose customers was published online this week including 582k unique email addresses with name, phone number and partial credit card data (type and last 4 digits). 79% were already in Have I Been Pwned. More: haveibeenpwned.com/Breach/CanadaG…

New breach: Fintech lending platform Figure had over 900k unique email addresses breached and posted publicly last week. Data included name, phone, DoB and physical address. 79% were already in Have I Been Pwned. Read more: haveibeenpwned.com/Breach/Figure

New breach: 431k unique email addresses allegedly sourced from CarMax were published online last month. Data also included names, phone numbers and physical addresses. 80% were already in Have I Been Pwned. Read more: haveibeenpwned.com/Breach/CarMax

New breach: CarGurus had more than 12M unique email addresses exposed in a breach earlier this month. Data also included names, phone numbers and physical and IP addresses. 70% were already in Have I Been Pwned. Read more: haveibeenpwned.com/Breach/CarGurus

New breach: Canadian Tire had 38M unique email addresses breached in October. Data also included name, phone, physical address, PBKDF2 password and partial credit card data. 86% were already in Have I Been Pwned. Read more: haveibeenpwned.com/Breach/Canadia…

New breach: 1M records from Dutch telco Odido have been published following a data breach, exposing 317k unique email addresses along with names, physical addresses, phone numbers and bank account numbers. 58% were already in Have I Been Pwned. More: haveibeenpwned.com/Breach/Odido

Updated breach: Allegedly the final release, a further 4.6M unique email addresses from Dutch telco Odido were published today. The total now stands at 6.1M unique addresses across four separate releases. More: haveibeenpwned.com/Breach/Odido

New breach: AI-powered comic generation platform KomikoAI suffered a breach last week that exposed 1M unique email addresses. Data included AI prompts and their mapping back to email addresses. 22% were already in Have I Been Pwned. Read more: haveibeenpwned.com/Breach/KomikoAI

New breach: Relationship app Lovora allegedly exposed 496k unique email addresses last month. Data also included display name, photo and other personal info. The developer did not respond to contact attempts. 12% were already in Have I Been Pwned. More: haveibeenpwned.com/Breach/Lovora

New breach: Recipe service Provecho allegedly had 713k unique email addresses obtained earlier this month. Data also included username and the creators accounts followed. 73% were already in Have I Been Pwned. Read more: haveibeenpwned.com/Breach/Provecho