ADDA adda.io ADDA data breach: what happened and what to do
In March 2025, data allegedly taken from ADDA, an app for managing housing societies in India, was posted online. Have I Been Pwned added 1.8 million accounts in November 2025: emails, names, phone numbers and MD5 password hashes.
View all 13,115 breaches- Breach date
- 24 Mar 2025
- Affected
- 1,829,314
- Data exposed
- Email addresses, Names, Passwords, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
ADDA, at adda.io, is software that residential housing societies in India use to run day-to-day community life, such as visitor entry and maintenance bills. In March 2025, data allegedly breached from the service was posted to a public hacking forum, according to Have I Been Pwned (HIBP). HIBP dates the incident to 24 March 2025 and added it to its database on 23 November 2025.
HIBP counted 1,829,314 accounts. Indian business outlet Entrackr reported a slightly higher figure of about 1.86 million records, taken from the poster's claim. That claim was unverified, and the company hadn't confirmed it. HIBP's number is the one counted from the data itself.
What was exposed
Each record in the data HIBP reviewed contained:
- An email address
- A name
- A phone number
- A password stored as an MD5 hash
MD5 is an old way of scrambling passwords. It is quick to compute, so attackers can test billions of guesses per second against a list of MD5 hashes. Short or common passwords tend to be recovered quickly. Long, random ones usually are not. If you picked a simple password for ADDA, assume it is no longer secret.
What this lets criminals do
Names, phone numbers and emails together are a phishing kit. A scammer who knows your name and number can text you as your housing society or a courier. Because ADDA is tied to where you live, messages about society dues or a parcel at the gate will look believable.
A cracked password is the bigger risk if you reuse it. Attackers try the recovered email and password pair on email providers and banks. If it works on any of them, they can reset other accounts through your inbox.
The entry does not list home addresses, payment details or government IDs. That is HIBP's reading of the data, so check the notice if ADDA publishes one.
The company's response
The coverage at the time reported no public statement from ADDA confirming the incident. HIBP describes the data as allegedly breached, which is how it labels incidents where the company hasn't confirmed what happened. If ADDA or your housing society sends an official notice, follow it, and be careful with any message that claims to be from them but pushes you to click a link.
What stays the same for you
The leaked data can't be pulled back from the forum where it was posted. The useful step is to make the data worthless: a new unique password, two-factor login where possible, and skepticism toward messages that use your name.
What to do if you were in it
- 1
Change your ADDA password, and any you reused
Change it on ADDA first, then on every other account that used the same or a similar password. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey where the site offers one. It stops most account takeovers even when a password has already leaked.
- 3
Expect texts and calls about your housing society
Scammers who have your name and number can pose as society staff, vendors or couriers. Don't pay dues or share OTPs over a call or text you didn't start. Contact your society office through a number you already trust.
- 4
Treat messages that mention the breach as suspect
Expect emails and texts that quote your name or details to look convincing. Don't click links in them; open the company's site yourself. Our guide to stopping spam emails helps with the flood.
- 5
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the ADDA data breach?
Look up your email address on Have I Been Pwned. If ADDA is listed, your email, name, phone number and password hash were in the data.
What was exposed?
Email addresses, names, phone numbers and MD5 password hashes, according to Have I Been Pwned.
Were passwords exposed in plain text?
No. They were MD5 hashes, which are easy to crack when the password is short or common.
Should I change my password?
Yes. Change your ADDA password and any account where you used the same one, and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
