Notable data breaches — what leaked, and what to do.
When a household-name service is breached, billions of email addresses land in credential-stuffing toolkits within hours. Below is a curated index of breaches that materially affected consumers worldwide. Run a free AICS check to find out which of these your email appears in.
Affected by any of these? Run a free check — AICS tells you in seconds which of these breaches your email appears in. Check my email →
LinkedIn (2021)
Approx. ~700 million records affected
A scraped database of 700 million LinkedIn profiles was put up for sale on a hacking forum. LinkedIn confirmed the data was real but characterised it as scraped public profile information rather than a server breach.
Data exposed
- Email addresses
- Phone numbers
- Job titles
- Profile URLs
Facebook (2019)
Approx. ~533 million records affected
Personal data on 533 million Facebook users from 106 countries was posted in a low-tier hacking forum in 2021, originally exfiltrated via a contact-import vulnerability fixed in 2019.
Data exposed
- Phone numbers
- Email addresses
- Names
- Locations
Ticketmaster (2024)
Approx. ~560 million records affected
Ticketmaster confirmed unauthorised access to a third-party cloud database in May 2024. The company notified regulators under GDPR and offered free identity-monitoring to affected customers worldwide.
Data exposed
- Names
- Email addresses
- Phone numbers
- Order history
- Partial card data
Mother of All Breaches (MOAB) (2024)
Approx. ~26 billion records affected
Researchers discovered an unsecured 12 TB database aggregating data from thousands of past breaches, including Twitter (X), LinkedIn, Tencent, Adobe, and many smaller services. Not a fresh breach — but a single index that made credential-stuffing attacks easier than ever.
Data exposed
- Aggregated credentials from prior breaches
National Public Data (2024)
Approx. ~2.7 billion records affected
A US-based background-check broker disclosed in August 2024 that 2.7 billion records — much of it US consumer PII — had been exfiltrated and posted online. Class-action suits followed in multiple jurisdictions.
Data exposed
- Names
- Addresses
- Social Security numbers (US)
- Email addresses
AT&T (2024)
Approx. ~73 million records affected
AT&T confirmed in March 2024 that customer data dating to 2019 or earlier had been released on the dark web. Affected customers were forced to reset account passcodes.
Data exposed
- Names
- Account numbers
- Phone numbers
- Encrypted passcodes
See exactly which passwords leaked, then rotate them.
For one-time buyers and members, Expert Investigation surfaces the actual leaked passwords from breach data so you know exactly which credentials to rotate first. Included with every paid plan until 30 June 2026.