TL;DR: Have I Been Pwned (HIBP) lists 20 breaches dated 2024 to 2026 with more than 31 million accounts each, ranging from 31.1 million (Internet Archive) to an aggregated credential-stuffing dataset of 2 billion. Several of the largest are stealer-log and credential-list collections rather than a single company hack. This list is a snapshot from HIBP’s public list and may not be exhaustive.

👉 Check my digital footprint — free 30-second check →

Breach counts are easy to misread: an “account” in HIBP is a unique email address in a dataset, the same person can appear in many datasets, and some entries are compilations of older leaks. This page lists the large ones with the figures HIBP publishes, and says plainly what it does not show.

Breaches over 31 million accounts listed on HIBP, dated 2024 to 2026
BreachBreach dateAdded to HIBPAccounts (rounded by HIBP)Our type label*
Synthient Credential Stuffing Threat DataApr 20256 Nov 20252 billioncredential list
Combolists Posted to TelegramMay 20243 Jun 2024361.5Mcredential list
ALIEN TXTBASE Stealer LogsFeb 202525 Feb 2025284.1Mstealer log
Not SOCRadarAug 20249 Aug 2024282.5Msee HIBP entry
Synthient Stealer Log Threat DataApr 202521 Oct 2025183.0Mstealer log
National Public Data (flagged unverified by HIBP)Apr 202413 Aug 2024134.0Msingle service
DemandScience by Pure IncubationFeb 202413 Nov 2024121.8Msingle service
Data Troll Stealer LogsJun 202513 Aug 2025109.5Mstealer log
1winNov 20243 Feb 202596.2Msingle service
Advance Auto PartsJun 202424 Jun 202479.2Msingle service
Under ArmourNov 202521 Jan 202672.7Msingle service
Stealer Logs, Jan 2025Jan 202513 Jan 202571.0Mstealer log
The Post MillennialMay 202410 May 202457.0Msingle service
Hot TopicOct 202411 Nov 202456.9Msingle service
June 2026 Stealer LogsJun 202615 Jun 202656.3Mstealer log
SunoNov 202520 Jul 202655.3Msingle service
Canadian TireOct 202525 Feb 202638.3Msingle service
AddiMar 202618 May 202634.5Msingle service
Neiman MarcusApr 20249 Jul 202431.2Msingle service
Internet ArchiveSep 20249 Oct 202431.1Msingle service

* The type label is ours, based on the breach title, and is not HIBP’s classification. “See HIBP entry” means we have not classified it from the title. Account counts are as shown on HIBP’s public list (rounded), except exact figures such as 284,132,969 for ALIEN TXTBASE Stealer Logs, 96,166,543 for 1win, 79,243,727 for Advance Auto Parts, 34,532,941 for Addi and 133,957,569 for National Public Data, which we read from HIBP’s API. Breach dates are month and year only. HIBP flags National Public Data as unverified, and the origin and accuracy of its data are uncertain. The list we read was cut off alphabetically after “Bookchor”, so entries beyond it may be missing.

Largest single-service breaches added to HIBP since 2024 (million accounts)Largest single-service breaches in the HIBP list: National Public Data 134 million, DemandScience 121.8, 1win 96.2, Advance Auto Parts 79.2, Under Armour 72.7, Post Millennial 57, Hot Topic 56.9, Suno 55.3.Largest single-service breaches added to HIBP since 2024 (million accounts)National Public Data (unverified)134.0MDemandScience121.8M1win96.2MAdvance Auto Parts79.2MUnder Armour72.7MThe Post Millennial57.0MHot Topic56.9MSuno55.3M
Largest single-service breaches added to HIBP since 2024 (million accounts). Source figures in the tables and Sources below.

Why the numbers are not “people affected”

HIBP counts accounts (email addresses) in each dataset. One person can appear in several breaches, and stealer-log and credential-list collections can repackage data from many sources. So the total of the rows in the table is not a count of affected people, and we do not sum it.

The data types differ by breach. For example, HIBP lists the 1win breach as including dates of birth, email addresses, geographic locations, IP addresses, passwords and phone numbers, and the Addi breach (March 2026) as including government-issued IDs, income levels, credit scores and phone numbers. Phone numbers and IDs matter because they are what impersonators use to sound credible on a call.

Our guide on the biggest data breaches in history explains what to do after a breach, and account takeover fraud covers what attackers do with leaked credentials. For related cases, see a SIM-swap case that began with stolen personal details, Scamwatch’s mobile number fraud alert and an international crackdown on groups selling stolen data. To see whether your own email or phone number has been exposed, run the free digital footprint check.

Breach data via Have I Been Pwned, licensed under CC BY 4.0.

How we compiled this data

We read the HIBP public breach list (PwnedWebsites) for entries with a breach date in 2024, 2025 or 2026 and more than 30 million accounts, and cross-checked several entries against the HIBP API. Counts on the public list are rounded by HIBP.

We did not check for breaches that appear only after the cut-off in the list we read, and we did not verify the underlying incidents ourselves. New breaches are added to HIBP continually, so treat this page as a dated snapshot.

Want to know what is exposed about you personally? Run our free digital footprint checker or read the what to do after a scam guide.

Frequently Asked Questions

What is Have I Been Pwned?

A free service that lists email addresses found in known data breaches, so people can check whether their address appears. This page uses its public breach list.

What was the largest breach on the list?

Synthient Credential Stuffing Threat Data, with about 2 billion accounts, added to HIBP on November 6, 2025. It is a credential-stuffing dataset rather than a single company breach.

Do these numbers show how many people were affected?

No. HIBP counts accounts (email addresses) in each dataset, one person can appear in many datasets, and some entries are compilations.

Is the list complete?

No. The list we read was cut off alphabetically after “Bookchor”, so some breaches may be missing, and new breaches are added to HIBP regularly.

Use this data

Download the CSV

Cite this page

Embed the main chart (free to use with the credit link kept in place)

The chart and compilation are ours; the underlying figures belong to the agencies listed under Sources, so check their terms before reusing the raw data.

Sources

Related Reading