Breaches

The largest social media breach ever: 34GB CSV file containing metadata for nearly 3 billion profiles was leaked by a disgruntled employee during Musk-era layoffs.

Largest social media breach ever: 34GB CSV file containing metadata for nearly 3 billion profiles. Allegedly leaked by disgruntled employee during Musk-era mass layoffs.

Automated attacks using leaked password databases to access accounts. Successful against accounts without 2FA or using reused passwords.

Phone numbers and email addresses from Facebook Marketplace users were leaked on hacker forums.

Google tracked iOS users' location even when Location History was disabled, using partnerships with apps like Uber and Instagram to continue monitoring.

Google paid $425 million to settle claims it tracked users' locations even when Location History was disabled, using partnerships with apps like Uber and Instagram.

Family tracking app Life360 was caught selling precise location data to data brokers, who then resold it to advertisers and potentially law enforcement.

Meta stored hundreds of millions of Facebook and Instagram passwords in plaintext from 2012-2019, accessible to 2,000 employees. Fined €91 million by Irish DPC.

The largest password compilation ever, containing nearly 10 billion unique passwords from multiple breaches over 20 years. If you've ever reused a password, it's likely in this list.

Coordinated SIM swap attacks targeting high-profile accounts. Attackers convinced carriers to transfer phone numbers, bypassing SMS-based 2FA and draining cryptocurrency wallets.

DOJ/FTC lawsuit revealed TikTok knowingly collected data from millions of children under 13, built backdoors to bypass age verification, shared children's data with advertisers, and refused to honor parent dele...

Investigations revealed that popular apps including weather, flashlight, and casual game apps were collecting and selling user location data, contact lists, and browsing history through embedded advertising SDK...

A threat actor posted a database containing phone numbers of approximately 3.5 billion WhatsApp users on a hacking forum. The data was allegedly scraped using WhatsApp's contact sync feature.

Attackers used passwords leaked from other sites to access 23andMe accounts, then scraped DNA and ancestry data from connected relatives. Users who reused passwords exposed their entire family.

Personal data from 2.5 million LinkedIn users including emails, job titles, and employer information was scraped and leaked.

Customer data including names, addresses, and phone numbers exposed through API vulnerability. Attackers used tracking identifiers to correlate data.

Irish DPC fined TikTok €345 million for GDPR violations related to children's accounts, including default public settings and insufficient age verification.

Email addresses of 200 million users leaked online, enabling mass phishing attacks and de-anonymization of pseudonymous accounts used by activists and journalists.

Email addresses of 200 million users leaked online, enabling de-anonymization of pseudonymous accounts used by activists, journalists, and whistleblowers.

Attackers stole encrypted password vaults from 30 million users. Users with weak master passwords or no 2FA were vulnerable to offline cracking attacks.

Hackers sold a dataset of 487 million WhatsApp phone numbers from 84 countries. Data was collected by exploiting WhatsApp's API to check if phone numbers were registered.

Phone numbers and personal data of 533 million Facebook users from 106 countries were leaked online after being scraped through a contact import vulnerability.

Data from 700 million LinkedIn users (92% of all users) was scraped and posted for sale, including email addresses, phone numbers, geolocation, and inferred salaries.

Hackers accessed Ring cameras to spy on families, yell at children through speakers, and demand Bitcoin ransoms. Ring blamed users for 'password reuse' despite lacking basic security features.