Adpost adpost.com Adpost data breach: what happened and what to do
In February 2025 data from an earlier Adpost breach surfaced. Have I Been Pwned counts 3,339,512 accounts: email addresses, usernames and display names. No passwords are listed.
View all 13,115 breaches- Breach date
- 14 Feb 2025
- Affected
- 3,339,512
- Data exposed
- Email addresses, Names, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Adpost is a classified ads and online marketplace site. In February 2025, data taken in an earlier breach of the site surfaced publicly. Have I Been Pwned (HIBP) dates the incident to 14 February 2025, added it on 7 October 2025 and counts 3,339,512 accounts.
What happened
HIBP says the dataset contained 3.3 million records of email addresses, usernames and display names. The data came from an earlier compromise, which means the breach itself happened before it showed up in public. That gap is common: stolen data can sit with one person for months before it is shared or sold.
HIBP's entry is the main public record of the incident. Details about how the attackers got in aren't spelled out there.
What was exposed
HIBP lists three data types: email addresses, names and usernames. No passwords, phone numbers, addresses or payment details are listed.
That makes it one of the milder breaches on paper. A short list of data types doesn't make it harmless, though, because the combination of a real email address, a username and a display name is useful for targeting.
What that lets criminals do
Classified sites are where people sell furniture, advertise services and answer strangers. Scammers already work these sites, and a leaked list tells them who is active on one.
The practical risks are these:
- Targeted phishing. A message addressed to your display name and mentioning Adpost looks like it comes from the site. Expect "your listing was flagged" or "verify your account" emails with a link to a fake login page.
- Username reuse. People often use the same username on several sites. An attacker can search for yours elsewhere and then try your other accounts, helped by any password you've reused.
- Fake buyer and seller scams. Knowing who has posted on a classifieds site helps a scammer pick victims for overpayment or fake-courier tricks.
Because there are no passwords in the entry, your Adpost password wasn't part of what HIBP lists. If the site ever forced a credential reset, that would reduce risk further, but you can't rely on that.
What the company said
HIBP's entry is the source for the figures on this page, and it states that the data came from an earlier Adpost breach. For anything about the company's own notices, check Adpost's site and its security announcements directly.
How to check
Search your email address on HIBP. If it appears under Adpost, you were in the dataset. Search any other email addresses you've used for classified ads as well, since people often have a separate address for marketplace listings.
Being listed doesn't mean someone has logged in as you. It means your email and username were circulating together.
What to do if you were in it
- 1
Expect phishing that uses your details
Emails, texts and calls that mention your name, employer or phone number are more believable. Don't click links in unexpected messages. Go to the company's site yourself, and treat urgent requests for money or codes as a red flag.
- 2
Change your Adpost password and any matching ones
If you still have an Adpost account, set a new password there. If you used the same password on another site, change that too.
- 3
Check where else you use the same username
If you use one username across forums, marketplaces and social accounts, consider changing it on the most important ones so it can't be used to link your accounts.
- 4
Be careful with marketplace messages
Keep buyer and seller conversations on the site. Be wary of anyone who wants to move to a private chat, send a cheque, or pay through a link they provide.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It checks breach databases for your email address and phone number and shows which breaches include you, so you know which passwords and accounts to deal with first.
Frequently asked
Was I affected by the Adpost breach?
Search your email address on Have I Been Pwned. It lists 3,339,512 accounts for Adpost.
What was exposed?
Email addresses, names and usernames. HIBP lists no passwords or payment details.
Do I need to change my password?
Passwords aren't listed, so it isn't urgent. Changing it is still sensible if you reuse it elsewhere.
Why did the data come out in 2025 if the breach was earlier?
HIBP says the data came from an earlier breach and surfaced in February 2025. Stolen data often circulates quietly before it becomes public.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
