New breach: Assurance Retraite suffered a breach in 2024 exposing 370k assistance beneficiaries with 70k unique email addresses. Data also included name, address, phone and French social security numbers (NIR). 59% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/AssuranceRetraite

New breach: Gîtes de France suffered a breach in May which exposed 118k unique email addresses alongside names, phone numbers, physical addresses and booking details. 76% of addresses were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/GitesDeFrance

New breach: In January, ShinyHunters targeted Crunchbase in a "pay or leak" extortion campaign. Published data included 560k email addresses, names, phone numbers, physical addresses, job titles and employers. 53% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/Crunchbase

New breach: An August ShinyHunters extortion campaign against Sharecare allegedly exposed 318k email addresses, mostly business contacts, plus some Brazilian health plan member data. 73% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/Sharecare

New breach: Neogen was targeted by ShinyHunters in August. Data allegedly stolen from the company was later published, including 436k unique email addresses, names and other mostly corporate contact details. 59% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/Neogen

New breach: CyrusOne faced a ShinyHunters extortion attempt in August. Alleged breach data was later published: 373k unique email addresses, names and largely corporate contact info for users and leads. 84% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/CyrusOne

New breach: Discord server protection service Double Counter suffered a breach earlier this week due to a Metabase vulnerability. The data included 275k unique email addresses and Discord usernames. 25% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/DoubleCounter

New breach: Angel One had 7.9M customer records breached in 2023, including 6.8M unique email addresses. Data included name, physical address, phone number, bank account number, PAN and portfolio holdings. 53% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/AngelOne

New sensitive breach: Swiss medical device company Medela was targeted in a ShinyHunters extortion attack this month. Allegedly breached data was later published, including 424k unique email addresses. 62% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/Medela

New breach: The LimeLeads B2B marketing platform (now defunct) had 17.8M unique email addresses exposed in 2019. Largely corporate contact data also included phone number, job title, employer and location. 50% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/LimeLeads

New breach: Burger King Russia had 3.2M unique email addresses exposed via the Mindbox marketing automation platform in 2024. Data also included names, phone numbers, genders, DoBs and geolocations. 60% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/BurgerKingRussia

New scrape: Last month, 4.6M email addresses from Chess[.]com were posted online with names, usernames and country, among other data. 99% were already in @haveibeenpwned, supporting the theory the data was scraped. Read more: https://haveibeenpwned.com/Breach/Chess2026

New sensitive breach: McKesson was targeted in a ShinyHunters extortion campaign last month. Allegedly sourced data was later published with 6.4M emails from marketing campaigns, patients, staff and others. 66% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/McKesson

New breach: Manchester Airports Group was breached last month, with FulcrumSec later publishing 8.7M email addresses. Data included phone numbers, vehicle registrations, parking history and airport purchases. 62% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/ManchesterAirportsGroup

New breach: Questel was targeted in a ShinyHunters extortion campaign last month. Data allegedly from the company was published with 1.2M emails, names, employers, job titles, addresses and phone numbers. 51% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/Questel

New breach: Carhartt was the target of a ShinyHunters extortion campaign earlier this month. Data allegedly obtained from the company was later published, including 12.9M unique email addresses. 83% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/Carhartt

New sensitive breach: German news service NIUS had 6k unique email addresses exposed in a breach last year. Data also included names, physical addresses, purchases and partial payment details. 51% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/NIUS

New breach: Golf Canada had 569k unique email addresses allegedly obtained from its service around the middle of this year. Data also included name, DoB, gender and appx geographic location. 76% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/GolfCanada

New breach: Oz Hair and Beauty was targeted in an xpl0itrs extortion attack this week. Data allegedly obtained in the attack was subsequently leaked, including 2M email addresses and other personal data. 73% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/OzHairAndBeauty

New breach: Fanlore suffered a breach earlier this month exposing 145k unique email addresses. Data also included usernames and passwords stored as either MD5 or PBKDF2 hashes. 23% were already in @haveibeenpwned. Read more: https://haveibeenpwned.com/Breach/Fanlore