Data Breach Database & Directory: 787 Known Breaches

Every breach we index, in one list. Filter by industry, year or password risk, or search a company name. Click any breach to see what leaked and what to do about it.

Last updated:

Want to check if your own email was affected? Try our free breach search.

Recently added

The newest entries, by the date we added them.

Recently added
BreachIndustryRecordsBreachedAdded
McKessonPharmaceutical6,832,822
LegionProxyInformation Technology10,148
Chess (2026)Entertainment4,656,591
FanloreEntertainment145,195
Baxter InternationalHealth Care488,992
Manchester Airports GroupTransport8,379,476
SharecareHealth Care326,356
LumenisHealth Care384,244

All 787 Breaches in the Directory (A to Z)

Every entry links to a detail page showing what data was exposed, how passwords were stored, and what to do about it. Breach year and exposed records in parentheses.

Total Breaches
787
Records Exposed
11.6B
Industries Affected
21
This Year
80

Search and filter all 787 breaches

787 breaches found

How this database is built

Each entry comes from a breach we've reviewed and loaded into XposedOrNot, the same data behind the free email check and the API. We record the breach date, how many records were exposed, the industry, what kinds of data leaked and how passwords were stored.

A green tick means we've verified the breach against its source. Entries marked sensitive are listed here but left out of public email search results, so the people in them aren't exposed twice.

The full method is on our methodology page, and developers can pull the same list from the free API.

Frequently asked questions

What is the XposedOrNot data breach database?

It's a free, searchable list of every publicly known breach we've loaded, 787 so far. Each entry shows the records exposed, the industry, the breach date, how passwords were stored and whether we've verified it. No account needed.

How do I search for breaches by industry or year?

Use the filters above the table for industry, year and password risk, or type a company name or domain into the search box. Filters combine, and Reset clears them.

What does password risk mean?

It's how the breached site stored passwords. Plain text means no protection, easy to crack means weak scrambling such as MD5 or SHA1, and hard to crack means strong scrambling such as bcrypt. Unknown means we couldn't tell from the data.

Is the breach database free?

Yes. Browse, search and filter without signing up. The same data is available through our free API if you'd rather pull it into your own tools.

How often is it updated?

Whenever a new breach is verified and loaded. The "Last updated" line at the top shows the newest addition, and every entry carries both its breach date and the date we added it.

Built by the community, for the community. Fully open-source on GitHub.

Legal
Privacy Policy Terms
Community
About Blog Our Repository Data Breach Check Integrations MCP Server
Trust
Status Transparency Responsible Disclosure Methodology
For Business
Free Domain Monitoring xonAPI+ xonThreatIntel+ Pricing
Follow Us
Twitter (X) Facebook Mastodon