Chess.com User Data Exposed in Large-Scale Scraping Incident In early August 2026, a dataset containing over 4.5 million unique email addresses linked to Chess.com accounts surfaced online. The breach notification service Have I Been Pwned (HIBP) indexed the data on September 13, 2026, revealing that the exposed records included email addresses, usernames, real names, geographic locations, and other account-specific details. The dataset, initially claimed by the threat actor V0idix, was advertised as a 15.5 GB file containing 7.3 million records scraped between July 26 and August 3, 2026. The leaked information reportedly extended to player ratings, subscription tiers, and internal advertising tags. Analysis indicates the data was scraped from public sources rather than obtained through a direct breach of Chess.com’s systems. HIBP noted that 99% of the exposed email addresses had appeared in prior breaches, reinforcing the theory that the information was aggregated from publicly accessible sources. This distinction is critical, as scraped data typically poses a lower risk than material stolen directly from internal databases. The incident highlights the ongoing risks of publicly exposed user data, even when no direct system compromise occurs. Chess.com, the world’s largest online chess platform, has not confirmed a breach, but affected users can verify their exposure through HIBP’s search tool.

56 Million Email Addresses and 124 Million Passwords Added to Have I Been Pwned from Infostealer Malware On June 15, 2026, the data breach notification service Have I Been Pwned (HIBP) expanded its database with 56.3 million unique email addresses and 124 million passwords, all compromised through infostealer malware targeting Windows PCs. Unlike typical corporate breaches, this dataset was extracted directly from infected devices, often without users’ knowledge. The stolen credentials originate from "stealer logs" records generated by infostealer malware that harvests saved passwords, browser data, cookies, and other sensitive information from compromised systems. While HIBP did not specify the exact malware strain or source of the logs, the scale highlights the growing threat of infostealers, which operate silently and can exfiltrate data over extended periods. Infostealers are a favored tool among cybercriminals due to their ability to bypass traditional breach detection. The addition of these records to HIBP’s Pwned Passwords database underscores the risk of credential theft at the endpoint level, not just through large-scale corporate breaches. Users can check if their email addresses are affected via HIBP’s platform, which now includes the new dataset. The incident serves as a reminder of the persistent threat posed by malware designed to exploit stored credentials on personal devices.

Atlas Menu Cheat Service Hit by Major Data Breach, Exposing 64K Users A significant data breach has struck Atlas Menu, a well-known paid cheating service for GTA 5 and Counter-Strike 2, affecting nearly 64,000 users. The incident, which occurred in May 2026, was confirmed by breach notification service Have I Been Pwned, though the platform itself has yet to acknowledge the attack or issue any public statement. The exposed data includes 63,926 unique email addresses, along with usernames, IP addresses, support ticket details, and passwords stored as bcrypt hashes. While the hashing method provides some security, the breach still poses risks for users who may have reused credentials across other platforms. Since the breach, Atlas Menu has gone offline, leaving affected users without official guidance. The lack of transparency raises concerns about the full scope of the incident and whether additional data may have been compromised. The service’s sudden disappearance suggests a possible shutdown, though no confirmation has been provided. The breach highlights the risks associated with third-party cheat services, which often operate outside standard security practices. Users of such platforms remain vulnerable to credential theft and other cyber threats, particularly if they reuse passwords across multiple accounts.

MyLovely.AI Data Breach Exposes Over 100,000 Users’ Sensitive Content A significant data breach at MyLovely.AI, an AI-powered platform for NSFW companionship and personalized content, has compromised the personal data of over 100,000 users. The incident, reported by Have I Been Pwned, exposed a range of sensitive information, including email addresses, user-generated prompts, AI-generated images, and social media profiles (such as Discord and X usernames). Leaked datasets, shared on a cybercrime forum, include user IDs, on-site content (prompts, images, metadata), and moderation reports, along with structured JSON files containing profile details, gallery items, community content, and subscription information. Notably, the breach contains 113,000 explicit NSFW prompts, with nearly 70,000 directly tied to specific user IDs, heightening privacy risks. Given the platform’s nature, affected users face potential sextortion threats, particularly if leaked data is linked to real-world identities. The exposure underscores the vulnerabilities in AI-driven adult content platforms handling highly personal interactions.

Massive Paidwork Data Breach Exposes 23 Million Users’ Financial and Personal Data In March 2026, hackers breached Paidwork, a global gig economy platform, compromising sensitive data belonging to over 23 million users. The stolen dataset initially listed for sale was later leaked in full on dark web forums in July 2026, totaling nearly 11GB of exposed information. The breach, first detected by Have I Been Pwned, included a trove of personal and financial records, such as: - Bank account numbers and transaction histories - Names, addresses, dates of birth, and genders - Email addresses, phone numbers, and profile photos - Device and IP address logs - Payout histories for gig workers - Passwords stored as bcrypt hashes (though vulnerable to cracking if weak) The combination of banking details and detailed personal profiles heightens risks of financial fraud, identity theft, and targeted phishing attacks. Cybercriminals could exploit payout histories to intercept payments or impersonate Paidwork, while device and IP data may facilitate account takeovers by bypassing security checks. Paidwork, which connects freelancers with clients, confirmed the exposure but has not disclosed the root cause of the breach. The incident underscores the severe consequences of large-scale data leaks, particularly when financial and identity-related information is involved.

BreachForums Suffers Data Breach, Exposing 324,000 User Accounts In August 2025, BreachForums the notorious cybercrime marketplace known for its repeated resurgences fell victim to a data breach, exposing sensitive details tied to approximately 324,000 user accounts. The incident, confirmed by Have I Been Pwned and added to its database on January 10, revealed email addresses, usernames, and Argon2-hashed passwords sourced from public posts, private messages, and forum records. The stolen data was later published on shinyhunte[.]rs by an individual identifying as "James," who accompanied the leak with a manifesto. Analysis by cybersecurity firm Resecurity found the database contained records linked to real cybercriminals, including individuals previously associated with groups like GnosticPlayers. PGP keys tied to handles such as ShinyHunters and IntelBroker were also present, though some entries appeared altered or partially scrubbed. The breach occurred just before law enforcement’s October 2025 takedown of BreachForums’ domain, with the most recent registration in the leaked data dated August 11 the same day the forum’s previous iteration at breachforums[.]hn was shut down. IP records, though obscured by VPN use, suggested heavy activity from the U.S. and Europe, alongside traffic from the Middle East and North Africa. BreachForums’ current administrator, N/A, acknowledged the incident in a public post, attributing the leak to a temporary lapse in security during the forum’s recovery. The admin claimed the exposed data was an old users-table from August 2025, stored briefly in an unsecured folder before being downloaded. N/A also speculated that "James" may be linked to the ShinyHunters collective, though this remains unverified. The leak raises concerns for those named, as cross-referencing the data could heighten risks of exposure and legal repercussions for cybercriminals. While the forum downplayed the incident as outdated, the public release transforms what was once semi-private forum data into a more accessible and dangerous resource.

Have I Been Pwned suffered from a data breach incident that exposed personal data including 33M NetProspex records. They sent mistakenly sent a very large file that contained 33,698,126 records and a 52.2GB CSV file.