Raaga raaga.com Raaga data breach: what happened and what to do
In December 2025, data allegedly taken from Raaga, an Indian music streaming service, was posted for sale. Have I Been Pwned added 10.2 million accounts in January 2026: emails, names, dates of birth and MD5-hashed passwords.
View all 13,115 breaches- Breach date
- 15 Dec 2025
- Affected
- 10,225,145
- Data exposed
- Ages, Dates of birth, Email addresses, Genders, Geographic locations, Names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Raaga is an Indian streaming service for Hindi, Tamil, Telugu and other regional music. In December 2025, data allegedly breached from the service was posted for sale on a hacking forum, according to Have I Been Pwned (HIBP). HIBP dates the incident to 15 December 2025 and added it on 19 January 2026.
HIBP counted 10,225,145 accounts and says the data holds about 10 million unique email addresses. Trade press, including TEISS, reported a similar scale of about 10.2 million records.
What was exposed
According to HIBP, the data included:
- Email addresses
- Names
- Genders
- Ages, and in some cases full dates of birth
- Geographic locations (postcodes)
- Passwords stored as unsalted MD5 hashes
Unsalted MD5 is a weak way to store a password. The same password always produces the same hash, so attackers can match hashes against huge precomputed lists. Simple or common passwords are cracked within moments.
What this lets criminals do
A date of birth plus a name and an email address is useful for identity fraud, because many services use those details to verify who you are. It will not be enough for most serious fraud on its own, but it helps an attacker pass a knowledge check or build a convincing profile.
The bigger everyday risk is credential stuffing. If your Raaga password was something you used elsewhere, an attacker who cracks the hash can try that email and password on your email provider, banking apps and shopping accounts.
Phishing is the third risk. A message that uses your real name and a service you actually used looks more trustworthy than a generic spam. Watch for fake "your music subscription failed" emails that ask for card details.
The company's response
Raaga hadn't published a notice that HIBP or the coverage cited. HIBP describes the data as allegedly breached, a label it uses when the company hasn't confirmed the details. If you get an email from Raaga about the incident, go to the Raaga app or site yourself instead of clicking links in the message.
What you can still control
You can't recall data that has already been posted. You can reduce what it is worth. Change the Raaga password and any account that shared it. Turn on two-factor login on your email first, because it is the account attackers use to reset everything else. If you gave Raaga a real date of birth, remember that it can't be changed, so be extra careful with any call or message that asks you to confirm it.
What to do if you were in it
- 1
Change your Raaga password, and any you reused
Change it on Raaga first, then on every other account that used the same or a similar password. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey where the site offers one. It stops most account takeovers even when a password has already leaked.
- 3
Be careful with your date of birth
A date of birth can't be changed, so treat any message or call asking you to confirm it as suspect. Give it only to services you contacted yourself.
- 4
Treat messages that mention the breach as suspect
Expect emails and texts that quote your name or details to look convincing. Don't click links in them; open the company's site yourself. Our guide to stopping spam emails helps with the flood.
- 5
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the Raaga data breach?
Look up your email on Have I Been Pwned. If Raaga is listed, your email and the other fields in the data were exposed.
What was exposed?
Email addresses, names, genders, ages (sometimes full dates of birth), locations and MD5-hashed passwords, per Have I Been Pwned.
Were passwords stored safely?
No. They were unsalted MD5 hashes, which are easy to crack, especially for common passwords.
Should I change my password?
Yes. Change the Raaga password and any other account that used it, and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
