Addi addi.com Addi data breach: what happened and what to do
In March 2026, the Colombian fintech Addi found unauthorized activity on its platform. Have I Been Pwned lists 34.5 million accounts from a later leak, with email addresses, names, phone numbers, addresses, government IDs, estimated income, credit scores and purchases. Addi said login credentials were not compromised.
View all 13,115 breaches- Breach date
- 25 Mar 2026
- Affected
- 34,532,941
- Data exposed
- Age groups, Credit scores, Device information, Email addresses, Government issued IDs, Income levels, IP addresses, Latitude and longitude pairs, Names, Phone numbers, Physical addresses, Purchases, Socioeconomic levels
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Addi, a Colombian buy-now-pay-later and fintech company, told customers that on March 25, 2026 it identified unauthorized access to part of its platform and that "it is possible that your personal information may have been compromised". El Colombiano reported that the platform had constant failures for almost two days, and that Addi said it was back to normal and under permanent monitoring. The company also said access credentials were not compromised, and asked customers to distrust unexpected calls, messages or emails asking for sensitive information.
Later, the extortion group ShinyHunters claimed responsibility and published a large amount of personal data allegedly taken from Addi, according to Have I Been Pwned. Its entry was added in May 2026 and counts 34,532,941 accounts. The data came from credit scoring requests, credit bureau records, customer identity records and email validation logs. That mix explains why the number is far larger than Addi's customer base: it includes people who were scored or checked, not only people with accounts.
What was exposed
Have I Been Pwned lists a wide set of data types: names, email addresses, phone numbers, physical addresses, government issued IDs (Colombia's Cédula de Ciudadanía), income levels, socioeconomic levels, credit scores, age groups, purchases, device information, IP addresses and latitude and longitude pairs.
What it means for you
A national ID number combined with a name, phone number and address is the core of an identity theft kit. Criminals can use it to impersonate you with lenders or telecom providers, to pass weak identity checks, or to craft messages that sound like they come from your bank. Credit scores, income and purchase history make those messages more believable: a scammer who knows roughly what you earn and what you buy can pitch a "loan offer" or "payment problem" that fits your life.
Phone numbers also enable smishing and SIM-swap attempts, where someone convinces your mobile provider to move your number to their SIM and then intercepts login codes. Location data and IP addresses are less likely to be misused directly, but they can reveal where you live or work.
The company's response
Addi has said it contained the incident and that credentials were not compromised. The sources reviewed don't include an official figure for how many people were affected, so the 34.5 million figure rests on Have I Been Pwned's count of the leaked data.
What Serus does here
You can't pull leaked data back from the places it circulates. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak, so you know when to take the next step.
What to do if you were in it
- 1
Watch for loan and identity fraud
Check your credit reports with the credit bureaus (such as DataCrédito or TransUnion Colombia) for accounts or inquiries you didn't make, and ask your bank about extra verification on your accounts.
- 2
Expect scams that mention your finances
Calls, texts and emails that quote your name, ID number, income or purchases can be built from this leak. Don't click links or share codes. Contact the company through its official app or site.
- 3
Protect your phone number
Ask your mobile provider about a PIN or extra checks before a SIM change, and use an authenticator app instead of SMS codes where possible.
- 4
Change reused passwords and turn on two-factor login
Addi said credentials were not compromised, but if you reuse your Addi password anywhere, change it there, and turn on two-factor login on your email and banking apps.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they appear in a new leak.
Frequently asked
Was I affected by the Addi data breach?
Search your email on Have I Been Pwned or run a free Serus scan. The leaked data includes people from credit scoring requests, not just Addi customers.
What was exposed in the Addi breach?
Names, emails, phone numbers, addresses, government IDs, income and socioeconomic levels, credit scores, purchases, device information, IP addresses and location coordinates, according to Have I Been Pwned.
Who is behind the Addi breach?
Have I Been Pwned says the extortion group ShinyHunters claimed responsibility and published the data. Addi itself has not named an attacker in the sources reviewed.
Should I change my password?
Addi said access credentials were not compromised. Change your password if you reuse it on other sites, and use a unique one for each account.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
