List of data breaches

This is a dynamic list and may never be able to satisfy particular standards for completeness. You can help by editing the page to add missing items, with references to reliable sources.

This is a list of reports about data breaches, using data compiled from various sources, including press reports, government news releases, and mainstream news articles. The list includes those involving the theft or compromise of 30,000 or more records, although many smaller breaches occur continually. Breaches of large organizations where the number of records is still unknown are also listed. In addition, the various methods used in the breaches are listed, with hacking being the most common.

As a result of data breaches, it is estimated that in first half of 2018 alone, about 4.5 billion records were exposed.^[1] In 2019, a collection of 2.7 billion identity records, consisting of 774 million unique email addresses and 21 million unique passwords, was posted on the web for sale.^[2] In January 2024, a data breach dubbed the "mother of all breaches" was uncovered.^[3] Over 26 billion records, including some from Twitter, Adobe, Canva, LinkedIn, and Dropbox, were found in the database.^[4][5] No organization immediately claimed responsibility.^[6]

List of data breaches involving a government or public entity

Government	Agency	Year	Records	Organization type	Method	Sources
Netherlands	National Police Corps of the Netherlands	2024	63,000+ staff members data including names, email addresses, phone numbers	police	hacked	[7]
United Kingdom	Transport for London	2024	5000+ Passengers data including home addresses, bank account details, unconfirmed number of Staff data leaked too	Local Transport authority	hacked	[8]
50 companies and government institutions	Various	2022	6,400,000	various	poor security	[9][10]
California	California Department of Corrections and Rehabilitation	2022	236,000 inmates personally identifiable information (PII) and protected health information (PHI)	government	CDCR denies any wrongdoing	https://www.cdcrdataclassactionsettlement.com/
India	Indian Council of Medical Research	2023	815,000,000+, including Aadhaar IDs, passport details, names, phone numbers, addresses	government	hacked by pwn0001	[11]
Australia	Australian Immigration Department	2015	G20 world leaders	government	accidentally published	[12]
Australia	Australian National University	2019	19 years of data	academic	hacked	[13]
Sydney, Australia	Western Sydney University	2024	7,500, including email accounts, SharePoint files, and the Microsoft Office 365 environment	academic	hacked	[14][15]
Bangladesh	Office of the Registrar General, Birth & Death Registration	2023	50,000,000+	government	data leak due to security vulnerabilities	[16]
United Kingdom	BBC	2024	25,290 employee pension records, including name, date of birth, home address, national insurance number	public broadcasting	hacked	[17][18]
United Kingdom	British Library	2023	unknown	government	ransomware	[19]
United Kingdom	British National Party	2008	Records	Politics		[20]
United Kingdom	City and Hackney Teaching Primary Care Trust	2007	160,000	healthcare	lost / stolen media	[21]
United Kingdom / Scotland	NHS Dumfries and Galloway	2024	still unknown	healthcare	cyber attack	[22][23]
Bulgaria	Bulgarian National Revenue Agency	2019	over 5,000,000	government	hacked	[24][25]
California	California Department of Child Support Services	2012	800,000	government	lost / stolen media	[26][27]
United States	Central Intelligence Agency	2017	91	malware tools	internal job	[28][29][30][31][32]
Colorado, US	Colorado Department of Health Care Policy & Financing	2010	105,470	healthcare	lost / stolen computer	[33]
Philippines	Commission on Elections	2016	55,000,000	government	hacked
United States	Consumer Financial Protection Bureau	2023	256,000	bureau	poor security	[34]
United States	Centers for Medicare & Medicaid Services	2018	75,000	healthcare	hacked	[35]
South Korea	Defense Integrated Data Center (South Korea)	2017	235 GB	government, military	hacked	[36]
United States	Democratic National Committee	2016	19,252	political	hacked	[37]
United States	Department of Homeland Security	2016	30,000	government	poor security	[38][39]
Indonesia	Directorate General of Immigration of Indonesia	2023	34,900,867	Government	hacked and published	[40]
Indonesia	Directorate General of Population and Civil Registration (Dukcapil)	2023	337,225,463	Government	leaked and published	[41]
United Kingdom	Driving Standards Agency	2007	3,000,000	government	lost / stolen media	[42]
Ecuador	?	2019	20,800,000 records, including names, family members, financial and work data, civil registration data, car ownership data	government	poor security / misconfigured server	[43]
?	Embassy Cables	2010	251,000	government	inside job	[44]
England/Wales	England and Wales Cricket Board	2024	43,299	government	unknown	[45]
European Union	European Central Bank	2014	unknown	financial	hacked	[46][47]
United States	FBI	2016	Records	law enforcement	hacked	[48][49][50]
United States	Federal Reserve Bank of Cleveland	2010	400,000	financial	hacked	[51]
Florida	Florida Department of Juvenile Justice	2013	100,000	government	lost / stolen computer	[52]
Unknown	Unknown	2020	201,000,000	personal and demographic data about residents and their properties of US	Poor security	[53]
Greece	?	2012	9,000,000	government	hacked	[54]
Singapore	Health Sciences Authority	2019	808,000	healthcare	poor security	[55]
Ireland	Health Service Executive	2021	unknown	healthcare	unknown	[56]
London, UK	Heathrow Airport	2017	2.5GB	transport	lost / stolen media	[57][58][59]
United States	Internal Revenue Service	2015	720,000	financial	hacked	[60][61]
Japan	Japan Pension Service	2015	1,250,000	special public corporation	hacked	[62]
Jefferson County, West Virginia	?	2008	1,600,000	government	accidentally published	[26][63]
Cedar Rapids, Iowa	Kirkwood Community College	2013	125,000	academic	hacked	[52][64]
Massachusetts, US	Massachusetts Executive Office of Labor and Workforce Development	2011	210,000, including names, Social Security numbers, employer identification numbers, emails, home addresses	government	hacked with a trojan	[65]
United States	Medicaid	2012	780,000	government, healthcare	hacked	[26]
Chile	Ministry of Education	2008	6,000,000, including ID card numbers, addresses, telephone numbers academic records	government	hacked	[66][67]
Chile	Servicio Electoral de Chile (Servel)	2019	14,308,151, including names, addresses, tax ID numbers	government	misconfigured server	[68]
Shanghai, China	Shanghai National Police Database	2022	1,000,000,000, including name, address, birthplace, national ID number, mobile number, all crime/case details	government	unsecured database	[69][70]
Singapore	Ministry of Health	2019	14,200	healthcare	poor security/inside job	[71][72]
Slovakia	National Health Information Center (NCZI) of Slovakia	2020	391,250	healthcare	poor security	[73]
Norway	Norwegian Tax Administration	2008	3,950,000	government	accidentally published	[74]
United States	Office of Personnel Management	2015	21,500,000	government	hacked	[75][76][77]
Texas, US	Office of the Texas Attorney General	2012	6,500,000	government	accidentally published	[78]
United Kingdom	Ofcom	2016	unknown	telecom	inside job	[79]
Columbus, Ohio	Ohio State University	2010	760,000, including names, Social Security numbers, dates of birth, addresses	academic	hacked	[80]
Oregon	Oregon Department of Transportation	2011	1,000,000, including names, addresses, dates of birth	government	hacked	[81][26]
Various	Pandora Papers	2021				[82]
Various	Paradise Papers	2017	records			[83]
Philippines	Commission on Elections	2016	records		hacked	[84]
Philippines	Various law enforcement agencies (Philippine National Police, National Bureau of Investigation, Bureau of Internal Revenue)	2023	1,279,437	government	poor security	[85]
Puerto Rico	Puerto Rico Department of Health	2010	515,000	healthcare	hacked	[86]
Argentina	RENAPER (Argentina)[87][88]	2018	45,000,000	government	poor security	[89][90]
Russia	Roscosmos	2022	handwritten forms, PDFs, spreadsheets, descriptions of lunar missions.	aerospace	hacked by v0g3lsec	[91]
Sakai City, Japan	?	2015	680,000	government	inside job	[92]
San Francisco, California	San Francisco Public Utilities Commission	2011	180,000	government	hacked	[93]
New South Wales, AU	Service NSW	2020	104,000	government	hacked	[citation needed]
United Kingdom	Service Personnel and Veterans Agency (UK)	2008	50,500	government	lost / stolen media	[94]
South Africa	South Africa police	2013	16,000	government	hacked	[95]
South Carolina, US	South Carolina Department of Revenue	2012	6,400,000	healthcare	inside job	[86][96][97][98]
Stanford, California	Stanford University	2008	72,000, including dates of birth, Social Security numbers, home addresses	academic	lost / stolen computer	[99][100]
Texas, US	?	2011	3,500,000	government	accidentally published	[101]
Syrian government (Syria Files)	Various	2012	2,434,899	government	hacked	[102][103]
Texas	Texas Lottery	2007	89,000+, including names, Social Security numbers, addresses, prize amounts	government	inside job	[104]
United States	Tricare	2011	4,901,432, including Social Security numbers, addresses, phone numbers, clinical notes, laboratory tests, prescriptions	military, healthcare	lost / stolen computer	[105][86]
United Kingdom	UK Home Office	2008	84,000	government	lost / stolen media	[106]
United Kingdom	UK Ministry of Defence	2008	1,700,000	government	lost / stolen media	[107]
United Kingdom	United Kingdom parliamentary expenses scandal	2009	Records	government		[citation needed]
United Kingdom	UK Revenue & Customs	2007	25,000,000	government	lost / stolen media	[108]
United Nations	?	2019	unknown	international	hacked	[109]
United Nations	?	2021	unknown	international	hacked	[110]
Berkeley, California	University of California, Berkeley	2009	160,000	academic	hacked	[111]
Berkeley, California	University of California, Berkeley	2016	80,000	academic	hacked	[112]
College Park, Maryland	University of Maryland, College Park	2014	300,000	academic	hacked	[113]
Orange County, Florida	University of Central Florida	2016	63,000	academic	hacked	[114]
Miami, Florida	University of Miami	2008	2,100,000	academic	lost / stolen computer	[115][116][117]
Salt Lake City, Utah	University of Utah Hospital & Clinics	2008	2,200,000	academic	lost / stolen media	[118]
Milwaukee, Wisconsin	University of Wisconsin–Milwaukee	2011	73,000	academic	hacked	[26]
Shah Alam, Malaysia	Universiti Teknologi MARA	2019	1,164,540	academic	hacked	[119]
United States	United States Postal Service	2018	60,000,000	government	poor security	[120]
United States	U.S. Army	2011	50,000	military	accidentally published	[26]
United States	U.S. Army	2010	392,000	government	inside job	[121]
United States	U.S. Department of Defense	2009	72,000	military	lost / stolen media	[26]
United States	U.S. Department of Veteran Affairs	2006	26,500,000	government, military	lost / stolen computer	[122][123][124]
United States	Various	2013			Insider
United States	Various	2020	TBC	government, military	hacked	[125][126][127][128]
United States	70 different law enforcement agencies	2011	123,461	government	accidentally published	[129]
United States	National Archives and Records Administration (U.S. military veterans records)	2009	76,000,000	military	lost / stolen media	[130]
United States	U.S. State Department	2010	260,000	military	inside job	[131]
United States	National Guard of the United States	2009	131,000, including names, Social Security Numbers, incentive payment amounts, payment dates	military	lost / stolen computer	[132][133]
Virginia, US	Virginia Prescription Monitoring Program	2009	8,257,378	healthcare	hacked	[26][134][135]
Washington, US	Washington State court system	2013	160,000	government	hacked	[136][137]
New Haven, Connecticut	Yale University	2010	43,000	academic	accidentally published	[26]
?	Unknown agency (believed to be tied to United States Census Bureau)	2020	200,000,000	financial	accidentally published	[138]
Bangladesh	Cox's BazarPolice and Khulna Metropolitan Police	2023	270,000		hacked	[139][140]
Pakistan	Habib Bank Limited	2025	Employee records, bank account details, education history, salaries data.	financial	hacked	[141][142]
Pakistan	Federal Board of Revenue	2025	150 GB data containing CNICs, names, phone numbers, addresses and tax records.	financial	hacked	[143][141]

List of data breaches involving companies

Entity	Year	Records	Organization type	Method	Sources
50 companies and government institutions	2022	6,400,000	various	poor security	[9][144]
21st Century Oncology	2015	2,200,000 customer's data, including names, Social Security numbers, physicians, diagnoses, insurance information	healthcare	hacked	[145][146][147]
23andMe	2023	6,900,000	consumer genetics	credential stuffing	[148]
500px	2020	14,870,304	social network	hacked	[149]
Accendo Insurance Co.	2020	175,350	healthcare	poor security	[150][151]
Accenture	2007				[citation needed]
Adobe Systems Incorporated	2013	152,000,000	tech	hacked	[152][153]
Adobe Inc.	2019	7,500,000	tech	poor security	[154][155]
ADT Inc.	2024	30,800, including email addresses, phone numbers and postal addresses.	security	accessing certain databases containing customer information	[156][157]
Advocate Medical Group	2017	4,000,000	healthcare	lost / stolen media	[158][159]
AerServ (subsidiary of InMobi)	2018	75,000	advertising	hacked	[160]
Affinity Health Plan, Inc.	2013	344,579	healthcare	lost / stolen media	[161][162]
Airtel	2019	320,000,000	telecommunications	poor security	[163]
Air Canada	2018	20,000	transport	hacked	[164]
Air India	2021	4,500,000, including name, date of birth, contact information, passport information, frequent flyer data, credit card data, ticket information	transport	hacked	[165][166]
Amazon Japan G.K.	2019	unknown	online	accidentally published	[167][168]
TD Ameritrade	2005	200,000	financial	lost / stolen media	[169]
Ameriprise Financial	2005	260,000 customer records	financial	stolen laptop	[170]
Ancestry.com	2021	300,000	genealogy	poor security	[171]
Animal Jam	2020	46,000,000	gaming	hacked	[172][173]
Ankle & Foot Center of Tampa Bay, Inc.	2021	156,000	healthcare	hacked	[174]
Anthem Inc.	2015	80,000,000	healthcare	hacked	[175][176][177]
AOL	2004	92,000,000	web	inside job	[178][179]
AOL	2006	20,000,000	web	accidentally published, (sometimes referred to as a "Data Valdez",[180][181][182] due to its size)	[183]
AOL	2014	2,400,000	web	hacked	[184]
Apple iCloud	2014	photographs of celebrities	tech, cloud storage		[185][186]
Apple, Inc./BlueToad	2021	12,367,232	tech, retail	accidentally published	[187]
Apple	2013	275,000	tech	hacked	[188]
Apple Health Medicaid	2021	91,000	healthcare	poor security	[189]
Ashley Madison	2015	32,000,000	dating	hacked	[190][191]
AT&T	2008	113,000	telecoms	lost / stolen computer	[192]
AT&T	2010	114,000	telecoms	hacked	[193]
AT&T	2021	72,000,000	telecoms	unknown	[194]
AT&T	2024	110,000,000	telecoms	hacked third party service	[195][196]
Atraf	2021	unknown	dating	hacked	[197]
Auction.co.kr	2008	18,000,000	web	hacked	[198]
Australian Red Cross Blood Service	2016	550,000, including names, contact details, birthdates, medical details, information about "at-risk sexual behaviour"	non-profit	accidentally published	[199][200]
Automatic Data Processing	2006	125,000	financial	poor security	[201]
AvMed, Inc.	2009	1,220,000	healthcare	lost / stolen computer	[202][203]
Bailey's Inc.	2015	250,000	retail	hacked	[204]
The Bank of New York Mellon	2008	12,500,000, including names, addresses, birth dates, Social Security numbers	financial	lost box of data tapes	[205][206]
Bank of America	2005	1,200,000	financial	lost / stolen media	[207]
Barnes & Noble	2012	63 stores	retail	hacked	[208][209]
Bell Canada	2017	1,900,000	telecoms	poor security	[210]
Bell Canada	2018	100,000	telecoms	hacked	[211]
Bell Canada	2024	2,200,000	telecoms	data leak (12 nov. breachforums)
Benesse	2014	35,040,000	educational services	hacked	[212]
Betfair	2010	2,300,000	gambling	hacked	[26]
Bethesda Game Studios	2011	200,000	gaming	hacked	[213]
Bethesda Game Studios	2018	customer names, addresses, contact details, partial credit card numbers	gaming	accidentally published	[214]
Betsson Group	2020	unknown	gambling	unknown	[215]
Blank Media Games	2018	7,633,234	gaming	hacked	[216][217]
Blizzard Entertainment	2012	14,000,000	gaming	hacked	[218][219]
BlueCross BlueShield of Tennessee	2009	1,023,039	healthcare	lost / stolen media	[220][221][86]
BMO and Simplii	2018	90,000	financial	poor security	[222]
Boeing	2006	382,000 employees (after similar losses of data on 3,600 employees in April and 161,000 employees in November, 2005)	transport	Lost/Stolen Device	[170]
British Airways	2018	500,000	transport	hacked	[223][224][225][226][227]
British Airways	2015	tens of thousands	transport	hacked	[228]
Callaway Golf Company	2023	1,114,954, including full names, shipping addresses, email addresses, phone numbers, order histories, account passwords, answers to security questions	sports	hacked	[229][230]
Canva	2019	140,000,000	web	hacked	[231][232][233][234][235]
Capcom	2020	350,000	gaming	hacked	[236]
Capital One	2019	106,000,000	financial	unsecured S3 bucket	[237][238][239]
CardSystems Solutions Inc. (MasterCard, Visa, Discover Financial Services and American Express)	2005	40,000,000	financial	hacked	[240][241]
Cathay Pacific Airways	2018	9,400,000	transport	hacked	[242]
CareFirst BlueCross Blue Shield - Maryland	2015	1,100,000	healthcare	hacked	[243]
Central Coast Credit Union	2016	60,000	financial	hacked	[244]
Central Hudson Gas & Electric	2013	110,000	energy	hacked	[52]
CheckFree Corporation	2009	5,000,000	financial	hacked	[245]
CGI Group	2007	283,000			[170]
CheckPeople	2020	56,000,000	background check	unknown	[246]
Chess.com	2023	800,000	gaming	web scraping	[247][248]
China Software Developer Network	2011	6,000,000	web	hacked	[249]
Chinese gaming websites (three: Duowan, 7K7K, 178.com)	2011	10,000,000	gaming	hacked	[250]
ChoicePoint	2005	163,000 consumer records	data aggregator	intentionally selling data	[251]
Citigroup	2005	3,900,000	financial	lost / stolen media	[252]
Citigroup	2011	360,083	financial	hacked	[253][254]
Citigroup	2013	150,000	financial	poor security	[255]
Clearview AI	2020	unknown (client list)	information technology	hacked	[256][257][258]
Collection No. 1	2019	773,000,000	various	compilation of multiple data breaches	[259]
Community Health Systems	2014	4,500,000	healthcare	hacked	[260]
Compass Bank	2007	1,000,000	financial	inside job	[261]
Countrywide Financial Corp	2008	2,500,000	financial	insider theft	[262][263][264][265]
Cox Communications	2016	40,000	telecoms	hacked	[266]
Crescent Health Inc., Walgreens	2013	100,000	healthcare, pharmacy	lost / stolen computer	[52][267]
Cutout.Pro	2024	19,972,829	web	hacked	[268]
CVS	2015	millions	pharmacy	hacked	[269]
CyberServe	2021	1,107,034	hosting provider	hacked	[270][271]
D. A. Davidson & Co.	2007	192,000 clients' names, customer account and Social Security numbers, addresses and dates of birth	broker/dealer	hacked by Latvian hackers	[272]
Dai Nippon Printing	2007	8,637,405, including names, addresses, credit card numbers	printing	inside job	[273][274]
Data Processors International (MasterCard, Visa, Discover Financial Services and American Express)	2008	8,000,000	financial	hacked	[275]
DC Health Link	2023	56,000	healthcare	misconfigured website	[276]
Dedalus Biologie (a division of Dedalus Global[88])	2021	500,000	healthcare	poor security	[277][278]
Dell	2024	49,000,000, including customer's names, addresses, order and hardware information	electronics	brute force attack by a "Dell partner"	[279][280][281]
Deloitte	2017	350 clients emails	consulting, accounting	poor security	[282][283]
Desjardins	2019	9,700,000	financial	inside job	[284]
Discord	2025	Limited numbers of names, usernames, emails, IP addresses, limited billing information	social network	third-party customer support services hacked	[285]
Diskunion	2022	701,000	retail	hacked	[citation needed]
Disney	2024	1.2 TB of internal Slack data	entertainment	hacked with a trojan	[286][287][288]
Domino's Pizza (France)	2014	600,000	restaurant	hacked	[289]
DonorView[87][88]	2023	948,029	charity	poor security	[290]
DoorDash	2019	4,900,000	web	hacked	[291]
Dropbox	2012	68,648,009	web	hacked	[292]
Drupal	2013	1,000,000	web	hacked	[293]
DSW Inc.	2005	1,400,000	retail	hacked	[294]
Dubsmash	2018	162,000,000	social network	hacked	[295][149]
Dun & Bradstreet	2013	1,000,000	tech	hacked	[296][297]
Duolingo	2023	2,676,696	educational services	web scraping	[298]
Earl Enterprises (Buca di Beppo, Earl of Sandwich, Planet Hollywood, Chicken Guy, Mixology, Tequila Taqueria)	2018	2,000,000	restaurant	hacked	[299]
EasyJet	2019	9,000,000 (approx) - basic booking, 2208 (credit card details)	transport	hacked	[300][301]
eBay	2014	145,000,000	e-commerce	hacked	[302]
Educational Credit Management Corporation	2010	3,300,000	nonprofit, financial	lost / stolen media	[303]
Eisenhower Medical Center	2011	514,330	healthcare	lost / stolen computer	[304][86]
Elance	2009	1.3 million	services	hacked	[305]
ElasticSearch	2019	108,000,000	tech	poor security	[306]
Emergency Healthcare Physicians, Ltd.	2010	180,111	healthcare	lost / stolen media	[307][308]
Emory Healthcare	2012	315,000	healthcare	poor security	[86]
Epic Games Fortnite	2018	user accounts	gaming	vulnerability	[309][310][311]
Epik	2021	15,000,000	web	hacked
Ernst & Young	2006	234,000 customers of Hotels.com (after a similar loss of data on 38,000 employees of Ernst & Young clients in February)			[170]
Equifax	2017	143,000,000, including names, date of birth, Social Security numbers, addresses, credit cards, driver's licenses	financial, credit reporting	poor security	[312][313][314][315]
EssilorLuxottica	2021	77,093,812	healthcare, retail	hacked	[316][317]
Evernote	2013	50,000,000	web	hacked	[318][319]
Evide data breach	2023	1,000	computer services for charities	ransomware hacked	[320][321][322][323][324]
Exactis	2018	340,000,000	data broker	poor security	[325]
Excellus BlueCross BlueShield	2015	10,000,000	healthcare	hacked	[326]
Experian	2020	23,000,000	finance	social engineering	[327]
Experian - T-Mobile US	2015	15,000,000	telecoms	hacked	[328][329]
EyeWire	2016	unknown	tech	lost / stolen computer	[330]
Facebook	2013	6,000,000	social network	accidentally published	[331]
Facebook	2018	50,000,000	social network	poor security	[332][333][334][335]
Facebook	2010	87,000,000	social network	data misuse	[336][337][338]
Facebook	2019	540,000,000	social network	poor security	[339][340]
Facebook	2019	1,500,000	social network	accidentally uploaded	[341]
Facebook	2019	267,000,000	social network	poor security	[342][343]
Facebook Marketplace	2023	200,000	social network	unknown	[344]
Fast Retailing	2019	461,091	retail	hacked	[345]
Fidelity National Information Services	2007	8,500,000	financial	inside job	[346]
Fidelity National Financial	2023	1,300,000	financial	hacked by ALPHV	[347][348]
Financial Business and Consumer Solutions (FBCS)	2024	4,250,000	financial	ransomware attack	[349][350][351]
First American Corporation	2019	885,000,000	financial	poor security	[352]
FireEye	2020	Unknown	information security	hacked	[353][354][355]
Friend Finder Network	2016	412,214,295	web	poor security / hacked	[356][357]
Funimation	2016	2,500,000	web	hacked	[358][359]
Formspring	2012	420,000	web	accidentally published	[360]
Game Freak	2024	2,606	gaming	hacked (phishing)	[361][362][363]
Gamigo[87][364]	2012	8,000,000	web	hacked	[365]
Gap Inc.	2007	800,000	retail	lost / stolen computer	[366][367]
Gawker	2010	1,500,000	web	hacked	[368][369]
GE Money	2008	650,000 customer's data, including 150,000 Social Security numbers and in-store credit card information from retail customers	financial	magnetic tape missing from an Iron Mountain Incorporated storage facility	[370]
Global Payments	2012	7,000,000	financial	hacked	[371]
Gmail	2014	5,000,000	web	hacked	[372]
Golfzon	2023	2,210,000, including names, phone numbers, email addresses, dates of birth	sports	ransomware/hacked	[373]
Google Plus	2018	500,000	social network	poor security	[374][375][376][377]
goregrish.com	2021	300,000	web	hacked	[378]
Grozio Chirurgija	2017	25,000	healthcare	hacked	[379][380][381]
GS Caltex	2008	11,100,000, including names, Social Security numbers, addresses, cell phone numbers, email addresses and workplaces of customers	energy	discs found in trash	[382][383]
Gyft	2016	unknown	web	hacked	[384][385]
Hannaford Brothers Supermarket Chain	2008	4,200,000, including credit card numbers and expiration dates	retail	hacked	[386]
HauteLook	2018	28,517,244	e-commerce	hacked	[387][388][389]
HCA Healthcare	2023	11,270,000	healthcare	hacked	[390]
Health Net	2009	1,500,000, including names, medical records, addresses, Social Security numbers	healthcare	lost / stolen media	[391][392]
Health Net — IBM	2011	1,900,000	healthcare	lost / stolen media	[393]
Heartland Payment Systems	2009	130,000,000	financial	hacked	[394][395][396][397]
Hewlett Packard	2006	200,000	tech, retail	lost / stolen media	[398]
Hilton Hotels	2014	363,000	hotel/casino	hacked	[399][400]
Home Depot	2014	56,000,000	retail	hacked	[401][402]
Honda Canada	2011	283,000, including names, addresses, VIN numbers, Honda Financial Services Account numbers, phone numbers, e-mail addresses	automotives	"unusual traffic"	[403][404]
Hyatt Hotels	2015	250 locations	hotel/casino	hacked	[405][406]
Iberdrola	2022	1,300,000	energy	poor security	[407]
IKEA	2022	95,000	retail	accidentally published	[408]
Infosys McCamish Systems	2023	57,028 Bank of America customers, including names and Social Security numbers 28,268 Fidelity Investments customers, including names, dates of birth, Social Security numbers, bank account and routing numbers, credit card numbers, passwords, PINs	tech	hacked	[409][410][411][412][413]
Insomniac Games	2023	1.67 TB, 1.3 million files of passports, I-9 forms, termination documents, Slack messages, Wolverine game data	gaming	hacked by Rhysida	[414]
Instagram	2020	200,000,000	social network	poor security	[415]
Ititan Hosting Solutions	2024	unknown	hosting provider	hacked / poor security	[416]
International Committee of the Red Cross	2022	515,000	humanitarian	unknown	[417][418][419]
Inuvik hospital	2016	6,700	healthcare	inside job	[420]
Iranian banks (three: Saderat, Eghtesad Novin, and Saman)	2012	3,000,000	financial	hacked	[421]
Japanet Takata	2004	510,000	shopping	inside job	[422]
JP Morgan Chase	2007	2,600,000	financial	lost / stolen media	[423]
JP Morgan Chase	2014	76,000,000	financial	hacked	[424]
Justdial	2019	100,000,000	local search	unprotected api	[425]
Kadokawa Corporation	2024	1.5TB of corporate, and personal information of users and employees of Niconico	web	ransomware hacking	[426]
KDDI	2006	4,000,000	telecoms	hacked	[427]
KitchenPal (iCuisto)	2023	100,000	web	hacked	[428]
KM.RU	2016	1,500,000	web	hacked	[429]
Koodo Mobile	2020	unknown	mobile carrier	hacked	[430]
Korea Credit Bureau	2014	20,000,000	financial, credit bureau	inside job	[431]
Kroll Background America	2013	1,000,000	tech	hacked	[296][297]
KT Corporation	2012	8,700,000	telecoms	hacked	[432][433]
LexisNexis	2014	1,000,000	tech	hacked	[296][297]
Landry's, Inc.	2015	500 locations	restaurant	hacked	[434][435]
LastPass	2015	password reminders, e-mail addresses	tech	hacked	[436]
LastPass	2022	Password vault backup	tech	poor security/hacked	[437]
Les Éditions Protégez-vous	2020	380,000	publisher (magazine)	unknown	[438]
LifeLabs[87][88]	2019	15,000,000	healthcare	hacked	[439]
Lincoln Medical & Mental Health Center	2010	130,495	healthcare	lost / stolen media	[440]
Line Yahoo	2023	520,006	social media/web	cyber infection/unautorized access	[441]
LinkedIn, eHarmony, Last.fm	2012	8,000,000	web	accidentally published	[442][443]
Living Social	2013	50,000,000	web	hacked	[444][445]
Lyca Mobile	2023	16,000,000	telecommunications	hacked	[446][447]
MacRumors.com	2014	860,000	web	hacked	[448]
Mandarin Oriental Hotels	2014	10 locations	hotel/casino	hacked	[449][450]
Manipulated Caiman	2023	40,000,000	financial	hacked	[451][317]
Marriott International	2018	500,000,000	hotel/casino	hacked	[452]
Marriott International	2020	5,200,000	hotel/casino	poor security/inside job	[453]
MediaWorks New Zealand	2023	162,710	media	hacked	[454]
Massive American business hack	2012	160,000,000	financial	hacked	[455]
Medibank & AHM	2022	9,700,000	healthcare	hacked	[citation needed]
Medical Informatics Engineering	2015	3,900,000	healthcare	hacked	[456]
Memorial Healthcare System	2011	102,153	healthcare	lost / stolen media	[457][86]
MGM Resorts	2019	10,600,000	hotel/casino	hacked	[458]
Michaels	2014	3,000,000	retail	hacked	[459]
Microsoft	2019	250,000,000	tech	data exposed by misconfiguration	[460]
Microsoft Exchange servers	2021	unknown	software	zero-day vulnerabilities	[461][462]
Militarysingles.com	2012	163,792	dating	accidentally published	[463]
Mitsubishi Tokyo UFJ Bank	2006	960,000	financial	intentionally lost	[345]
MongoDB	2019	202,000,000	tech	poor security	[464]
MongoDB	2019	275,000,000	tech	poor security	[465]
Mossack Fonseca	2016	Panama Papers			[466][467][468][469]
Mobile TeleSystems (MTS)	2019	100,000,000	telecommunications	misconfiguration/poor security	[470]
Monster.com	2007	1,600,000	web	hacked	[471]
Morgan Stanley Smith Barney	2011	34,000	financial	lost / stolen media	[26]
Morinaga Confectionery	2022	1,648,922	food	ransomware hacked	[472]
Mozilla	2014	76,000	web	poor security	[473]
MyHeritage	2018	92,283,889	genealogy	unknown	[474]
Myspace	2016	360,000,000+, including usernames, passwords email addresses	social network	poor security/account recovery	[475][476][477]
NASDAQ	2014	unknown	financial	hacked	[478]
National Public Data	2024	2,900,000,000+ (claimed), including names, email addresses, phone numbers, Social Security numbers, and mailing addresses	data broker	hacked	[479][480][481]
Natural Grocers	2015	93 stores	retail	hacked	[482]
NEC Networks, LLC[87][88]	2021	1,600,000	healthcare	hacked	[483]
Neiman Marcus	2014	1,100,000	retail	hacked	[484][485]
Nemours Foundation	2011	1,055,489	healthcare	lost / stolen media	[86][486]
Network Solutions	2009	573,000	tech	hacked	[487][488]
Newegg	2018	credit card information	e-commerce	maliciously injected Javascript	[489][490]
New York City Health & Hospitals Corp.	2010	1,700,000	healthcare	lost / stolen media	[86]
New York State Electric & Gas	2012	1,800,000	energy	inside job	[26]
New York Taxis	2014	52,000	transport	poor security	[491]
Nexon Korea Corp	2011	13,200,000	gaming	hacked	[492]
NHS	2011	8,630,000	healthcare	lost / stolen media	[493]
Nintendo (Club Nintendo)	2013	240,000	gaming	hacked	[494]
Nintendo (Nintendo Account)	2020	160,000	gaming	hacked	[495]
Nippon Television	2016	430,000	media	hacked	[236]
Now:Pensions	2020	30,000	financial	rogue contractor	[496]
NTT Business Solutions	2023	9,000,000	telecoms	hacked	[497]
NTT Docomo	2023	5,960,000	telecoms	hacked	[498]
OGUsers	2022	529,000	web	hacked	[499]
Optus	2022	9,800,000	telecommunications	hacked	[500]
Orbitz	2018	880,000	web	hacked	[501]
OVH	2013	undisclosed	web	hacked	[502]
PANDORA	2025	name, birthdate, email address	jewelry	hacked third party service	[503]
Pandora Papers	2021				[82]
Paradise Papers	2017	records			[83]
Patreon	2015	2,300,000	web	hacked	[504]
PayPay	2020	20,076,016	QR code payment	improper setting, hacked	[505]
Persol Carrier	2024	549,195	outsourcing service	system deficiency	[citation needed]
Popsugar	2018	123,857	media	hacked	[506]
Premera	2015	11,000,000	healthcare	hacked	[507]
Quest Diagnostics	2019	11,900,000	clinical laboratory	poor security	[508]
Quora	2018	100,000,000	question & answer	hacked	[509][510]
Rakuten	2020	1,381,735	e-commerce	improper setting, hacked	[505]
Rambler.ru	2012	98,167,935	web	hacked	[511][512]
Razer	2020	100,000, including email and mailing addresses, product orders, and phone numbers.	tech	misconfigured server	[513]
RBS Worldpay	2008	1,500,000	financial	hacked	[514]
Reddit	2018	usernames, emails, 2007 database backup	social network	employee account compromise	[515]
Reddit	2021	unknown	social network	hacked	[516][515]
Restaurant Depot	2011	200,000	retail	hacked by Russian hackers	[517][518]
Roblox	2016	52,458, including account balances, email addresses, IP addresses, purchases, usernames	gaming	exposed test server	[519]
Roblox	2023	3,943, including names, usernames, dates of birth, physical addresses, email addresses, IP addresses, phone numbers, and T-shirt sizes.	gaming	unknown	[520][521]
RockYou!	2009	32,000,000	web, gaming	hacked	[522]
Roku	2024	15,363 accounts	tech	credential stuffing attack	[523]
Roll20	2018	4,000,000, including email addresses, IP addresses, names, the last four digits of credit cards	web, gaming	hacked	[524][525]
Roll20	2024	12,000,000, including full names, email addresses, IP addresses, the last four digits of credit cards	web, gaming	compromised administrative account	[526][527]
Rosen Hotels[87][88]	2016	unknown	hotel/casino	hacked	[528]
Saks Fifth Avenue / Lord & Taylor	2018	credit card records	retail	hacked	[529]
Scottrade	2015	4,600,000	financial	hacked	[530]
Scribd	2013	500,000	web	hacked	[531][532]
Seacoast Radiology, PA	2010	231,400	healthcare	hacked	[86][533]
Sega	2011	1,290,755	gaming	hacked	[534]
Shadow PC	2023	533,624, including full names, email addresses, dates of birth, billing addresses and credit card expiration dates	tech	social engineering	[535][536]
ShopBack	2020	unknown	e-commerce	hacked	[537]
SingHealth	2018	1,500,000	healthcare	hacked	[538][539][540]
Slack	2015	500,000	tech	poor security	[541]
SlickWraps	2020	377,428	phone accessories	poor security	[542]
Snapchat	2013	4,700,000	social network	hacked	[543]
Snowflake	2024	Up to 165 victims, including AT&T, Ticketmaster, Advanced Auto Parts, Lending Tree, Cylance, Santander Bank and Neiman Marcus.	tech, data storage	compromised credentials	[544][545][546][547]
SolarWinds	2020	Source Code Compromised	network monitoring	hacked	[548]
Sony Online Entertainment	2011	24,600,000	gaming	hacked	[549][550]
Sony Pictures	2011	1,000,000, including passwords, email addresses, phone numbers, home addresses, dates of birth	web	hacked by LulzSec	[551]
Sony Pictures	2014	100 terabytes	media	hacked	[552][553]
Sony PlayStation Network	2011	77,000,000	gaming	hacked	[554]
South Shore Hospital, Massachusetts	2010	800,000	healthcare	lost / stolen media	[26]
Southern California Medical-Legal Consultants	2011	300,000	healthcare	hacked	[555][556]
Spartanburg Regional Healthcare System	2011	400,000, including names, Social Security numbers, addresses, dates of birth and medical billing codes	healthcare	lost / stolen computer	[557][558]
Spoutible	2024	207,114	social network	misconfigured API	[559]
Staples	2014	customer payment cards	retail	hacked	[560]
Starbucks	2008	97,000, including names, addresses, and Social Security numbers	restaurant	lost / stolen computer	[561][562][563]
Starwood including Westin Hotels & Resorts and Sheraton Hotels and Resorts	2015	54 locations	hotel/casino	hacked	[564][565]
Steam	2011	35,000,000	gaming	hacked	[566]
StockX	2019	6,800,000	e-commerce	hacked	[567]
Stratfor	2011	?	military	hacked	[568]
Supervalu	2014	200 stores	retail	hacked	[569]
Sutter Medical Center	2011	4,243,434	healthcare	lost / stolen computer	[570]
Taobao	2016	20,000,000	e-commerce	hacked	[571]
TalkTalk	2015	records	telecom	hacked	[572]
Tangerine Telecom	2024	243,462	telecom	compromised credentials	[573]
Taringa!	2017	28,722,877	web	hacked	[574]
Target Corporation	2013	110,000,000	retail	hacked	[575][576][577]
TaxSlayer.com	2016	8,800	web	hacked	[578][579][580]
TD Ameritrade	2007	6,300,000	financial	hacked	[581]
TD Bank	2012	260,000	financial	hacked	[582][583]
TerraCom & YourTel	2013	170,000	telecoms	accidentally published	[584][585]
Tesla	2023	75,000	transport	inside job	[586]
Tetrad	2020	120,000,000	market analysis	poor security	[587]
Ticketfly (subsidiary of Eventbrite)	2018	26,151,608	ticket distribution	hacked	[588]
Ticketmaster	2018	40,000, including login information, payment data, addresses, names, phone numbers	ticket distribution	maliciously modified Javascript	[589][590]
Ticketmaster	2024	560,000,000	ticket distribution	hacked third party service	[591][592]
Tic Hosting Solutions (known as Torchbyte)	2023	46	hosting provider	misconfigured web server	[593][416][594]
Tianya Club	2011	28,000,000	web	hacked	[595]
TikTok	2020	42,000,000	social network	poor security	[415]
TK / TJ Maxx	2007	94,000,000	retail	hacked	[596][597]
T-Mobile, Deutsche Telekom	2006	17,000,000, including phone numbers, addresses, dates of birth, email addresses	telecoms	lost / stolen media	[598][599]
T-Mobile	2021	45,000,000	telecom	hacked	[600]
T-Mobile	2023	37,000,000	telecom	hacked	[601]
Tokopedia	2020	91,000,000	e-commerce	hacked	[602]
Trello	2024	15,111,945	tech	misconfigured API	[603]
Triple-S Salud, Inc.	2010	398,000	healthcare	lost / stolen media	[604]
Truecaller	2019	299,055,000	telephone directory	unknown	[605][606]
Trump Hotels	2014	8 locations	hotel/casino	hacked	[607][608]
Tumblr	2013	65,469,298	web	hacked	[609]
Twilio	2022	125	tech	phishing attack	[610][611]
Twilio	2024	33,000,000, including phone numbers,	tech	credential stuffing attack	[612][613]
Twitch	2015	unknown	tech	hacked	[614]
Twitch	2021	unknown	tech	hacked/misconfiguration	[615]
Twitter	2013	250,000	social network	hacked	[616]
Typeform	2018	unknown	tech	poor security	[242]
Uber	2014	50,000	transport	poor security	[617]
Uber	2017	57,000,000	transport	hacked	[618]
Uber	2022	No customer, driver, or sensitive personal data was directly stolen. Exposure of sensitive data from internal systems.	transport	hacked	[619]
Ubisoft	2013	unknown	gaming	hacked	[620]
Ubuntu	2013	2,000,000	tech	hacked	[621]
UCLA Medical Center, Santa Monica	2015	4,500,000	healthcare	hacked	[622]
U-Haul	2023	67,000, including full names, dates of birth, driver license numbers	transport	stolen credentials	[623][624]
MyFitnessPal[625][626]	2018	150,000,000	consumer goods	hacked	[627][628]
UPS	2014	51 locations	logistics	hacked	[629]
Vastaamo	2020	130,000	healthcare	hacked	[630]
Verifications.io (first leak)	2019	809,000,000	online marketing	poor security	[631]
Verifications.io (total leaks)	2019	2,000,000,000	online marketing	poor security	[632]
Verizon Communications	2016	1,500,000	telecoms	hacked	[633]
View Media	2020	38,000,000	online marketing	publicly accessible Amazon Web Services (AWS) server	[634]
Virgin Media	2020	900,000	telecoms	accidentally exposed	[635][636]
Vodafone	2013	2,000,000	telecoms	inside job	[637]
VTech	2015	5,000,000	retail	hacked	[638]
Walmart	2015	1,300,000	retail	hacked	[269]
Washington Post	2011	1,270,000	media	hacked	[639]
Wattpad	2020	270,000,000	web	hacked	[640]
Wawa (company)	2020	30,000,000	retail	hacked	[641]
Weebly	2016	43,430,316	web	hacked	[642][643]
Wellnow Urgent Care	2023	patients’ names, dates of birth, health information	healthcare	ransomware hacked	[644]
Wendy's	2015	unknown	restaurant	hacked	[645][646]
Westpac	2019	98,000	financial	hacked	[647]
Woodruff Arts Center	2019	unknown	arts group	poor security	[648]
WordPress	2018	thousands of websites	web services	vulnerabilities in plugins	[649]
Writerspace.com	2011	62,000	web	hacked	[650]
Xat.com	2015	6,054,459	web	social engineering	[651]
Yahoo	2013	3,000,000,000	web	hacked	[652][653]
Yahoo	2014	500,000,000	web	hacked	[654][655][656][657][658]
Yahoo Japan	2013	22,000,000	tech, web	hacked	[659]
Yahoo! Voices	2012	450,000	web	hacked	[660][661]
YouTube	2020	4,000,000	social network	poor security	[415]
Yum! Brands	2023	names, driver's license numbers, and other ID card numbers.	restaurant	ransomware attack	[662][663]
Zappos	2012	24,000,000	e-commerce	hacked	[664]
Zynga	2019	173,000,000	social network	hacked	[665][666]

See also

• List of cyberattacks
• List of phishing incidents
• List of security hacking incidents