Naz.API data breach: what happened and what to do
In September 2023, a 100GB collection of stealer logs and credential stuffing lists called Naz.API was posted online. Have I Been Pwned loaded it in January 2024: about 71 million unique email addresses, paired with passwords and, often, the site they were used on.
View all 13,115 breaches- Breach date
- 20 Sept 2023
- Affected
- 70,840,771
- Data exposed
- Email addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Naz.API is the name of a large collection of stolen logins that was posted to a hacking forum in September 2023. Have I Been Pwned added it in January 2024. It isn't the breach of one company. It's a compilation of two kinds of data: stealer logs and credential stuffing lists.
Stealer logs come from malware on people's own devices. The malware records the logins a browser has saved, and the criminal gets the site, the email address and the password. Credential stuffing lists are pairs of emails and passwords from earlier leaks, bundled together to try on other sites.
What was exposed
Have I Been Pwned counts about 71 million unique email addresses in the data. The records contained email addresses and passwords, and many also noted the service the login was used on. The collection held more than 100 million unique passwords in total.
Troy Hunt, who runs Have I Been Pwned, found that a large share of the addresses was already in his database from other breaches, and that a lot of the passwords looked old. Still, about a third of the addresses were new to the site.
Why this one matters
Because the entries come from infected devices and recycled leaks, being in Naz.API usually means a password you really used. If you reused it, an attacker can try it on your email, shopping and bank accounts. If a stealer log caught you, the malware may have grabbed more than passwords, so scan the device for malware too.
What to do
Check your email on Have I Been Pwned. If it's listed, change any password you still use that could have been in the data, starting with email, banking and social accounts. Use a different password on each site and switch on two-factor login. Run a malware scan on the devices you log in from.
What to do if you were in it
- 1
Change the password, and every place you reused it
Change your email and any account you reused it on password, then change it on any other account that used the same or a similar one. A password manager makes a unique password for each site painless. Turn on two-factor login wherever it's offered.
- 2
Scan your devices for malware
Stealer logs come from infected computers and phones. Run your operating system's built-in scanner or a reputable antivirus, and remove anything it finds before you change passwords.
- 3
Stop saving passwords in the browser if you can
Stealer malware targets browser-saved logins. A dedicated password manager with a master password is harder to empty out.
- 4
Check Have I Been Pwned's Pwned Passwords
Your password manager can check each saved password against the Pwned Passwords list, which includes passwords from this collection. Replace anything it flags.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your details and alerts you when they show up in a new leak, so you know when to repeat these steps.
Frequently asked
Was I affected by the Naz.API leak?
Have I Been Pwned lists about 71 million unique email addresses. Search yours there, or run a free Serus scan.
What was exposed?
Email addresses and passwords, and in many records the service the login was used on.
Is Naz.API a breach of one company?
No. It's a compilation of stealer logs and older credential stuffing lists, so the logins come from many different sites and devices.
Should I change my password?
Yes, for any account whose password you've reused or haven't changed in years, starting with your email.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
