Last updated:

📋 HIBP Breach Catalog

Every breach loaded into Have I Been Pwned — 1,047 as of 21 Oct 2026, fetched live — searchable, sortable, free.

Loading…
Breach Accounts Date Data exposed
Snapshot — October 21, 2026: HIBP's free breaches endpoint returned 1,047 breaches totalling about 17.85 billion breached accounts (summed per breach, so the same person can count many times); 1,005 are flagged verified, 95 sensitive, 16 spam lists, 9 malware, 6 stealer logs, 3 fabricated and 2 retired, and 112 were added in 2026. The largest single entry is Synthient Credential Stuffing Threat Data (about 1.96 billion accounts, added 6 Nov 2025). The table above loads live data, so its numbers can be higher. HIBP API v3 (21 Oct 2026) The two new entries since 18 October are Gîtes de France (117,574 accounts, added 18 Oct 2026) and Assurance Retraite (70,372 accounts, added 20 Oct 2026). Breach data from Have I Been Pwned, licensed CC BY 4.0.

What is in the HIBP breach catalog?

This page renders the full Have I Been Pwned breach catalog — every breach HIBP has loaded, not every breach ever disclosed — as a sortable, searchable table. The list comes straight from HIBP's free, keyless /api/v3/breaches endpoint in your browser on each visit; nothing you type is sent anywhere. Click (or focus and press Enter on) any column header to sort, and use the search box to filter by service name or domain.

For each breach you'll see when it happened, how many accounts were exposed, what kind of data was leaked (passwords, addresses, phone numbers, payment info, etc.), and HIBP's flags (verified, sensitive, spam list, malware, stealer log and others).

For OSINT investigations: when a target uses a service that has been breached, the data classes column tells you what types of identifiers may now be searchable in dumps. Pair this catalog with a stealer-log check (Hudson Rock) and the Pwned Passwords tool for a full breach picture.

16 Oct 2026 — added a box on big breaches that are not in HIBP, starting with the IDScan.net driver’s-licence breach.

Which big breaches are not in HIBP?

HIBP can only list breaches whose data it has loaded. Some large breaches are not in it, such as the one below, so a clean result here does not mean your data is safe.

IDScan.net driver’s-licence breach (2026): not in HIBP, and no lookup exists. On 1 September 2026 KrebsOnSecurity reported a service called Nexus that claimed to sell scans of more than 153 million US and Canadian driver’s licences. Krebs linked the images to IDScan.net, a Louisiana ID-verification company, and the FBI opened an inquiry KrebsOnSecurity (1 Sep 2026). IDScan says an unauthorised third party had access to part of its cloud environment from 4 April to 2 September 2026, limited to its VeriScan platform. The data could include names, contact details, dates of birth and driver’s licence or other ID numbers IDScan.net notice (posted 4 Sep, updated 29 Sep 2026).

The numbers conflict. The 153 million figure is the seller’s claim and IDScan has not confirmed it BleepingComputer (10 Sep 2026). A Texas breach listing dated 21 September gives 13 million people affected eSecurity Planet (28 Sep 2026). IDScan’s own notice gives no number. It offers free credit monitoring and identity protection, with a call centre on 1-833-516-2980 IDScan.net notice (posted 4 Sep, updated 29 Sep 2026). When we checked HIBP’s live list on 16 October 2026 (1,045 breaches), it had no IDScan entry.

What you can do (US):

Frequently asked questions

What is this list?
Every breach that has been loaded into Have I Been Pwned — 1,047 entries when we checked on 21 October 2026, including spam lists and malware corpora, not every breach ever disclosed. Each entry includes the breach name, date, account count, types of data exposed, and HIBP's flags. The table is fetched live from HIBP's free /api/v3/breaches endpoint each time the page loads (HIBP lets browsers cache it for up to five minutes), so it is usually newer than the snapshot figures on this page.
How many breaches and accounts are in HIBP?
On 21 October 2026 the free breaches endpoint returned 1,047 breaches whose account counts add up to about 17.85 billion; 112 of them were added in 2026, and the newest was added on 20 October 2026. That total is a sum of per-breach counts, so a person who appears in ten breaches is counted ten times — it is not the number of unique people or email addresses affected. Leaving out the 16 spam lists brings the sum to about 16.37 billion. The live figure at the top of the table is recalculated from the same endpoint every time the page loads.
What do the flags mean?
Verified = HIBP is confident the data came from the named service; an unverified breach may not have been hacked from that site. Fabricated = the breach is unlikely to have come from the indicated site. Sensitive = HIBP treats the breach as sensitive (e.g. Ashley Madison) and does not reveal its email addresses through public searches. Retired = the data has been permanently removed and is no longer returned by the API. Spam list = the data did not come from a security compromise. Malware = the data came from a malware campaign rather than a compromise of the service. Stealer log = info-stealer data where HIBP also holds the website domains logged against each email address. Definitions follow HIBP's API documentation.
Can I check if my own email appears in any of these?
Yes — but not on this page. Searching HIBP by email through the API has required a paid subscription key since API v3 in July 2019, as an anti-abuse measure. Visit haveibeenpwned.com directly to check an email for free.
How is this different from the Pwned Passwords tool?
Pwned Passwords checks whether a specific password (not an account) has appeared in any breach. It uses k-anonymity so the password never leaves your browser. The catalog browser here lists the breaches themselves so you can investigate which services have been compromised.
Is the IDScan driver’s licence breach in Have I Been Pwned?
No. When we checked on 16 October 2026 HIBP had no IDScan entry, and there is no public lookup for it. A seller claimed more than 153 million licence scans, while a Texas breach listing gives 13 million people affected, and IDScan has not published a number. If you have had your ID scanned at a venue, consider a free credit freeze at Equifax, Experian and TransUnion, and use IdentityTheft.gov if your details are misused.

Related OSINT tools

🔐
Pwned Passwords
Check a password (k-anonymity)
→
📧
Email OSINT
Multi-source email OSINT
→
📋
OSINT Tool Graveyard
Why old breach search tools died
→