7. Yahoo
Big date: 2014Impact: 500 million records
Generating their 2nd appearance contained in this list was Yahoo, which experienced an attack in 2014 separate for the one in 2013 cited over. On this occasion, state-sponsored stars stole data from 500 million accounts such as labels, email addresses, cell phone numbers, hashed passwords, and dates of beginning. The organization got original remedial actions back in 2014, nevertheless wasna€™t until 2016 that Yahoo gone general public because of the facts after a stolen databases went on deal from the black market.
8. Xxx Pal Finder
Day: October 2016Impact: 412.2 million profile
The adult-oriented social networking solution The FriendFinder circle had 20 yearsa€™ worthy of of user information across six databases stolen by cyber-thieves in October 2016. Considering the sensitive character of this solutions provided by the business a€“ including everyday hookup and adult articles website like mature pal Finder, Penthouse, and Stripshow a€“ the violation of data from more than 414 million profile including labels, email addresses, and passwords had the possibility to getting specifically damming for sufferers. Whata€™s considerably, nearly all of the exposed passwords are hashed via the infamously poor algorithm SHA-1, with approximately 99per cent of these damaged once LeakedSource published their review with the data put on November 14, 2016.
9. MySpace
Time: 2013Impact: 360 million consumer accounts
Though it have long quit are the powerhouse it used to be, social media marketing website MySpace strike the statements in 2016 after 360 million user records are released onto both LeakedSource and set on the market on dark colored web market The Real Deal with an asking price of 6 bitcoin (around $3,000 during the time).
Based on the business, forgotten information incorporated email addresses, passwords and usernames for a€?a percentage of records that have been developed ahead of June 11, 2013, regarding older Myspace system. So that you can protect all of our customers, we’ve got invalidated all consumer passwords for your impacted account created before June 11, 2013, regarding older Myspace program. These people time for Myspace might be encouraged to authenticate her profile and reset their unique password following guidance.a€?
Ita€™s thought that the passwords comprise kept as SHA-1 hashes regarding the first 10 characters of code converted to lowercase.
10. NetEase
Big date: Oct 2015Impact: 235 million consumer account
NetEase, a supplier of mailbox services through wants of 163 and 126, reportedly suffered a breach in October 2015 whenever email addresses and plaintext passwords regarding 235 million profile were offered by dark colored web industry seller DoubleFlag. NetEase has managed that no facts violation happened and to this day HIBP states: a€?Whilst there’s facts that data is actually genuine (several HIBP clients verified a password they normally use is in the data), as a result of problem of emphatically verifying the Chinese breach it was flagged as a€?unverified.a€?
11. Courtroom Projects (Experian)
Time: October 2013Impact: 200 million individual files
Experian part courtroom projects decrease victim in 2013 whenever a Vietnamese guy tricked they into offering your use of a databases that contain 200 million individual files by posing as a personal investigator from Singapore. The important points of Hieu Minh Ngoa€™s exploits merely involved light following their arrest for attempting to sell personal data people citizens (such as credit card numbers and societal safety figures) to cybercriminals around the globe, things he had come doing since 2007. In March 2014, he pleaded responsible to numerous charges like personality fraudulence in the US region courtroom your District of brand new Hampshire. The DoJ mentioned at the time that Ngo got produced a maximum of $2 million from offering individual data.
12. LinkedIn
Big date: 
Summer 2012Impact: 165 million people
Having its 2nd look about this listing is LinkedIn, this time around in mention of a violation it endured in 2012 when it revealed that 6.5 million unassociated passwords (unsalted SHA-1 hashes) was in fact stolen by attackers and published onto a Russian hacker community forum. But isna€™t until 2016 that complete extent in the incident ended up being revealed. The exact same hacker promoting MySpacea€™s information is discovered to be providing the email addresses and passwords of approximately 165 million LinkedIn consumers for just 5 bitcoins (around $2,000 at the time). LinkedIn acknowledged so it was basically made conscious of the breach, and stated they have reset the passwords of stricken accounts.
13. Dubsmash
Go out: December 2018Impact: 162 million individual account
In December 2018, unique York-based movie chatting services Dubsmash got 162 million emails, usernames, PBKDF2 password hashes, also personal data such dates of beginning stolen, all of these ended up being put up for sale in the fantasy marketplace dark web marketplace the subsequent December. The content had been sold included in a collected dump additionally such as the wants of MyFitnessPal (much more about that below), MyHeritage (92 million), ShareThis, Armor video games, and internet dating app CoffeeMeetsBagel.
Dubsmash acknowledged the violation and sale of information had happened and given advice around password modifying. But didn’t say the assailants got in or confirm the amount of people happened to be suffering.
14. Adobe
Big date: Oct 2013Impact: 153 million user reports
During the early Oct 2013, Adobe stated that hackers got taken nearly three million encoded visitors charge card registers and login data for an undetermined many consumer records. Days afterwards, Adobe enhanced that estimation to add IDs and encoded passwords for 38 million a€?active customers.a€? Security writer Brian Krebs after that stated that a file submitted only days early in the day a€?appears to feature a lot more than 150 million username and hashed password pairs obtained from Adobe.a€? Days of data revealed that the tool got also uncovered visitors labels, code, and debit and charge card suggestions. An agreement in August 2015 required Adobe to pay $1.1 million in legal costs and an undisclosed total people to settle boasts of breaking the Customer reports Act and unjust businesses practices. In November 2016, extent compensated to customers was actually reported becoming $one million.