Data breach list: recent and past breaches

A data breach is when a company loses control of the personal data it holds: attackers break in, an employee leaks it, or a database is left open online. The data then gets sold, traded or posted, and it's used for account takeovers, phishing and identity fraud.

You can't pull leaked data back. What you can do is close the doors it opens: change the password, and every other account that used it, turn on two-factor sign-in, watch for phishing that uses the leaked details, and freeze your credit if your Social Security number was exposed.

Breach data from Have I Been Pwned, licensed under CC BY 4.0; the U.S. Department of Health and Human Services' breach portal; and the public breach notices of the California and Washington Attorneys General (Washington counts are state residents only). Sensitive breaches (such as adult and dating sites), spam lists, fabricated breaches and malware logs aren't listed.