Skip to content

JEDI-SEC | Security Research & Digital Defense

Home
Research
About
Recovered PDFs
#TG23: The First Signal
Office of Strategic Services
Darkz Youtube
Privacy Policy

Tag: Phone numbers

СберСпасибо (SberSpasibo) data breach — 3,288,711 accounts
In March 2023, data allegedly taken from СберСпасибо (SberSpasibo), the loyalty program of Russian bank Сбербанк (Sberbank), was published online. The data contained records relating to 48M users, including 3.3M unique email addresses alongside phone numbers and dates of birth. Data also included bank card numbers stored as unsalted SHA-1 hashes, plus loyalty program details such as membership dates and the redemption of bonus points for partner offers.
- Breach date: 2023-03-09
- Added to HIBP: 2026-11-11 01:44 UTC
- Compromised accounts: 3,288,711
- Compromised data: Bank card numbers, Dates of birth, Email addresses, Loyalty program details, Phone numbers
- Domain: spasibosberbank.ru
- Verified: Yes
Source: Have I Been Pwned — Breaches · 2026-11-11
November 11, 2026
Assurance Retraite data breach — 70,372 accounts
In September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries. The data included 70k unique email addresses along with names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers (NIR) and contact details of relatives or other nominated contacts. In its disclosure notice, Assurance Retraite attributed the breach to a compromised partner account.
- Breach date: 2024-09-01
- Added to HIBP: 2026-10-20 02:29 UTC
- Compromised accounts: 70,372
- Compromised data: Dates of birth, Email addresses, Family members’ names, Government issued IDs, Income levels, Marital statuses, Names, Phone numbers, Physical addresses
- Domain: lassuranceretraite.fr
- Verified: Yes
Source: Have I Been Pwned — Breaches · 2026-10-20
October 20, 2026
Gîtes de France data breach — 117,574 accounts
In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, including 118k unique email addresses alongside names, phone numbers, postal addresses and booking details.
- Breach date: 2026-05-16
- Added to HIBP: 2026-10-18 04:50 UTC
- Compromised accounts: 117,574
- Compromised data: Booking details, Email addresses, Names, Phone numbers, Physical addresses
- Domain: gites-de-france.com
- Verified: Yes
Source: Have I Been Pwned — Breaches · 2026-10-18
October 18, 2026
Crunchbase data breach — 559,908 accounts
In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters “pay or leak” extortion attempt. Data allegedly obtained from the company was subsequently published publicly and included 560k unique email addresses, largely belonging to leads and business contacts. Other data included names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. Crunchbase later confirmed that a threat actor had exfiltrated documents from its corporate network.
- Breach date: 2026-01-22
- Added to HIBP: 2026-10-14 06:01 UTC
- Compromised accounts: 559,908
- Compromised data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Social media profiles
- Domain: crunchbase.com
- Verified: Yes
Source: Have I Been Pwned — Breaches · 2026-10-14
October 14, 2026
Sharecare data breach — 318,185 accounts
In August 2026, the digital health company Sharecare was the target of a ShinyHunters “pay or leak” extortion campaign. The group subsequently published data it claimed was taken from Sharecare’s systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers. The data also included a small number of Brazilian health insurance plan members, including dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer identification numbers).
- Breach date: 2026-08-12
- Added to HIBP: 2026-10-12 23:28 UTC
- Compromised accounts: 318,185
- Compromised data: Dates of birth, Email addresses, Employers, Genders, Government issued IDs, Job titles, Marital statuses, Names, Phone numbers, Physical addresses
- Domain: sharecare.com
- Verified: Yes
Source: Have I Been Pwned — Breaches · 2026-10-12
October 12, 2026
Neogen data breach — 435,963 accounts
In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters “pay or leak” extortion attempt. The group later published data it claimed had been obtained from Neogen. The data consisted largely of corporate contact records and included 436k unique email addresses from mailing lists, employee records and other contacts.
- Breach date: 2026-08-29
- Added to HIBP: 2026-10-09 07:06 UTC
- Compromised accounts: 435,963
- Compromised data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Salutations
- Domain: neogen.com
- Verified: Yes
Source: Have I Been Pwned — Breaches · 2026-10-09
October 9, 2026
CyrusOne data breach — 373,460 accounts
In August 2026, data centre operator CyrusOne was the target of a ShinyHunters “pay or leak” extortion attempt. The group subsequently published data allegedly obtained from the company, which included 373k unique email addresses across records relating to users, sales leads and CyrusOne employees. The data largely consisted of corporate contact information, including names, physical addresses, phone numbers and job titles. It also included support tickets and other information related to the organisation’s operations.
- Breach date: 2026-08-05
- Added to HIBP: 2026-10-07 23:19 UTC
- Compromised accounts: 373,460
- Compromised data: Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets
- Domain: cyrusone.com
- Verified: Yes
Source: Have I Been Pwned — Breaches · 2026-10-07
October 7, 2026
Angel One data breach — 6,765,054 accounts
In July 2024, the Indian stock brokerage firm Angel One confirmed that data leaked online related to a breach that occurred in April 2023. The leaked data included 7.9M user records containing 6.8M unique email addresses, along with names, physical addresses, phone numbers, bank account numbers, Permanent Account Numbers (PANs) and portfolio holdings. Angel One emphasised that the breach “has no impact on client securities, funds, or credentials”.
- Breach date: 2023-04-01
- Added to HIBP: 2026-10-07 03:45 UTC
- Compromised accounts: 6,765,054
- Compromised data: Bank account numbers, Dates of birth, Email addresses, Financial investments, Government issued IDs, Names, Phone numbers, Physical addresses
- Domain: angelone.in
- Verified: Yes
Source: Have I Been Pwned — Breaches · 2026-10-07
October 7, 2026

JEDI-SEC | Security Research & Digital Defense

Independent security research. Practical digital defense.

NAVIGATION

Home
Research
About

JEDI-SEC // Verify claims. Protect systems. Share knowledge.