Personal data leaks
Every recorded case of a company or public body that lost, exposed or handed over data on private people: what left, how it got out, what followed, and the database behind it.
Personal data leaks
Every recorded case of a company or public body that lost, exposed or handed over data on private people: what left, how it got out, what followed, and the database behind it.
| When | Who | What left | How | Then |
|---|
| When | Who | What left | How | Then |
|---|
Gart app for family & teams
Hold one button to trigger your alert. Your location and your response plan go with it.
Gart app →
Free download
Personal OpSec Checklist
A sample of our operational security checklist. Gart Training clients receive the extended version in print.
Download the checklist →
Private advisory
Talk to a Gart advisor
One 90-minute call, on the topics you choose. Or one full day with our trainer.
Advisory & training →
Gart app for family & teams
Hold one button to trigger your alert. Your location and your response plan go with it.
Gart app →
Free download
Personal OpSec Checklist
A sample of our operational security checklist. Gart Training clients receive the extended version in print.
Download the checklist →
Private advisory
Talk to a Gart advisor
One 90-minute call, on the topics you choose. Or one full day with our trainer.
Advisory & training →Credit line
Source: gart.io
- The records summarize public reporting. The linked articles belong to their publishers.
- Tell us where you used the data if you can. We read what gets built on it and we correct what you find wrong.
API
- Data leaks
sqlite-leaks.gart.io/api/leaks
Every published incident as JSON: when, who, what left, how, what followed and source links. - It answers a plain GET without a key.
Credit line
Source: gart.io
- The records summarize public reporting. The linked articles belong to their publishers.
- Tell us where you used the data if you can. We read what gets built on it and we correct what you find wrong.
API
- Data leaks
sqlite-leaks.gart.io/api/leaks
Every published incident as JSON: when, who, what left, how, what followed and source links. - It answers a plain GET without a key.
Public sources only
Every entry is a publicly reported incident with a link to its source.
Real numbers are higher
Many attacks and leaks are never reported. We estimate the real numbers are several times what the records show, so read every count here as a minimum.
Claims stay claims
Figures are the ones the company, the authorities or the researchers who found the data reported. What an attacker says is marked as a claim.
Four steps
We read every physical attack in four steps: targeting, how the attackers chose the victim; approach, how they got to the victim; attack, the type of attack; and outcome, how it ended and what the attackers obtained.
Labels
Each of the 4 steps has a fixed set of labels. A case can carry more than one label in each step, for example Attack: home invasion, followed by kidnapping.
Open to correction
If an entry is wrong or missing, write to us and we will check it against the sources.
Report a case or an error →Public sources only
Every entry is a publicly reported incident with a link to its source.
Real numbers are higher
Many attacks and leaks are never reported. We estimate the real numbers are several times what the records show, so read every count here as a minimum.
Claims stay claims
Figures are the ones the company, the authorities or the researchers who found the data reported. What an attacker says is marked as a claim.
Four steps
We read every physical attack in four steps: targeting, how the attackers chose the victim; approach, how they got to the victim; attack, the type of attack; and outcome, how it ended and what the attackers obtained.
Labels
Each of the 4 steps has a fixed set of labels. A case can carry more than one label in each step, for example Attack: home invasion, followed by kidnapping.
Open to correction
If an entry is wrong or missing, write to us and we will check it against the sources.
Report a case or an error →The labels of each leak. A leak can carry more than one data and aftermath label.
Who held the data
Sector
- Finance
- Banks, payment and money transfer firms, brokers, investment platforms, wealth managers, lenders, credit bureaus and insurers.
- Identity vendors
- Companies that verify identity for other companies.
- Government
- Public bodies, registers, tax offices and police.
- Crypto
- Exchanges, wallet makers, crypto ATMs, on-ramps and their vendors.
- Luxury
- Luxury retailers, fashion houses, jewellers, auction houses and makers of luxury cars.
- Other
- Any other holder of personal data.
Verification
- Confirmed
- The holder or a public authority confirmed the incident.
- Reported
- Reported by a named publication or researcher; the holder has not confirmed or has said little.
- Claimed
- Rests on what the attacker or seller says. The text marks the figures as a claim.
- Disputed
- The named holder denies that the data is its own or that it was breached. The text carries the denial.
How the data left
Leak type
- Theft
- An outsider took the data: intrusion, stolen credentials, a breach at a vendor, or staff tricked into giving access.
- Handover
- The holder released the data itself to a requester who was not who they claimed to be: a fraudulent emergency data request, a forged subpoena or court order, a fake regulator or auditor.
- Insider
- A person with legitimate access (employee, former employee, contractor) copied, sold or passed on the data.
- Exposure
- The data was left reachable without a break-in: an open database, a public storage bucket, a misdirected export.
- Compilation
- A file assembled from earlier leaks and offered as one set.
- Unknown
- The sources do not say how the data left.
Vector
- Fake legal request
- Fraudulent emergency data request (EDR), forged subpoena, warrant or court order, usually sent from a compromised police or government mailbox.
- Pretexting
- Staff talked into releasing data or access by someone posing as a customer, colleague or supplier: voice phishing, support-desk social engineering.
- Bribed insider
- Staff or a contractor paid by an outsider to copy records.
- Rogue insider
- Staff, former staff or a contractor acting on their own, including access that was never revoked.
- Third party
- The data left through a vendor or processor (support desk, email, shipping, e-commerce, banking, claims), or through the holder's account at that vendor.
- Open storage
- A database or storage bucket readable from the internet without a password.
- Software flaw
- A vulnerability in the holder's own systems or in software it runs.
- Account takeover
- Stolen or guessed credentials, access tokens or API keys used to log in, including a SIM swap of a staff phone number.
- Compilation
- Assembled from earlier leaks.
- Undisclosed
- The sources do not say.
What left
Data in the leak
- Name
- Full name.
- Address
- Home, postal or shipping address.
- Location
- Coarser than an address: city, ZIP code, country of residence.
- Date of birth
- Date of birth.
- Phone
- Phone number.
- Email address.
- ID document
- Image or scan of a passport, identity card or driving license.
- Selfie
- Verification selfie, video or other biometric capture.
- National ID number
- Social security, tax or national identity number, in full or in part.
- Nationality
- Nationality or citizenship.
- Family
- Details of a spouse, children or other relatives.
- Bank account
- Bank account, routing or card numbers.
- Account ID
- Customer, membership or account number at the holder.
- Balance
- Account balance or a snapshot of holdings at the provider.
- Transactions
- Statements or transaction history.
- Wallet
- Wallet addresses, extended public keys, device serials, or proof that a person owns a hardware wallet.
- Wealth
- Income, tax, ownership or other financial details held outside an account.
- Order history
- What the person bought and when.
- Messages
- Private messages or support tickets.
- IP address
- IP address or device identifiers.
- Credentials
- Passwords, password hashes, seeds or 2FA secrets.
- Employment
- Employer, job title or HR records.
What followed
Aftermath
- Sale
- Offered for sale.
- Publication
- Published or dumped.
- Extortion
- A ransom or extortion demand to the holder or to the people in the data.
- Phishing
- Phishing or scam attempts that used the data.
- Impersonation
- The holder or its staff were impersonated to the people in the data.
- Physical threat
- Threats of a visit or of violence that used the data.
- Physical attack
- A documented attack on a person that used the data.
The labels of each leak. A leak can carry more than one data and aftermath label.
Who held the data
Sector
- Finance
- Banks, payment and money transfer firms, brokers, investment platforms, wealth managers, lenders, credit bureaus and insurers.
- Identity vendors
- Companies that verify identity for other companies.
- Government
- Public bodies, registers, tax offices and police.
- Crypto
- Exchanges, wallet makers, crypto ATMs, on-ramps and their vendors.
- Luxury
- Luxury retailers, fashion houses, jewellers, auction houses and makers of luxury cars.
- Other
- Any other holder of personal data.
Verification
- Confirmed
- The holder or a public authority confirmed the incident.
- Reported
- Reported by a named publication or researcher; the holder has not confirmed or has said little.
- Claimed
- Rests on what the attacker or seller says. The text marks the figures as a claim.
- Disputed
- The named holder denies that the data is its own or that it was breached. The text carries the denial.
How the data left
Leak type
- Theft
- An outsider took the data: intrusion, stolen credentials, a breach at a vendor, or staff tricked into giving access.
- Handover
- The holder released the data itself to a requester who was not who they claimed to be: a fraudulent emergency data request, a forged subpoena or court order, a fake regulator or auditor.
- Insider
- A person with legitimate access (employee, former employee, contractor) copied, sold or passed on the data.
- Exposure
- The data was left reachable without a break-in: an open database, a public storage bucket, a misdirected export.
- Compilation
- A file assembled from earlier leaks and offered as one set.
- Unknown
- The sources do not say how the data left.
Vector
- Fake legal request
- Fraudulent emergency data request (EDR), forged subpoena, warrant or court order, usually sent from a compromised police or government mailbox.
- Pretexting
- Staff talked into releasing data or access by someone posing as a customer, colleague or supplier: voice phishing, support-desk social engineering.
- Bribed insider
- Staff or a contractor paid by an outsider to copy records.
- Rogue insider
- Staff, former staff or a contractor acting on their own, including access that was never revoked.
- Third party
- The data left through a vendor or processor (support desk, email, shipping, e-commerce, banking, claims), or through the holder's account at that vendor.
- Open storage
- A database or storage bucket readable from the internet without a password.
- Software flaw
- A vulnerability in the holder's own systems or in software it runs.
- Account takeover
- Stolen or guessed credentials, access tokens or API keys used to log in, including a SIM swap of a staff phone number.
- Compilation
- Assembled from earlier leaks.
- Undisclosed
- The sources do not say.
What left
Data in the leak
- Name
- Full name.
- Address
- Home, postal or shipping address.
- Location
- Coarser than an address: city, ZIP code, country of residence.
- Date of birth
- Date of birth.
- Phone
- Phone number.
- Email address.
- ID document
- Image or scan of a passport, identity card or driving license.
- Selfie
- Verification selfie, video or other biometric capture.
- National ID number
- Social security, tax or national identity number, in full or in part.
- Nationality
- Nationality or citizenship.
- Family
- Details of a spouse, children or other relatives.
- Bank account
- Bank account, routing or card numbers.
- Account ID
- Customer, membership or account number at the holder.
- Balance
- Account balance or a snapshot of holdings at the provider.
- Transactions
- Statements or transaction history.
- Wallet
- Wallet addresses, extended public keys, device serials, or proof that a person owns a hardware wallet.
- Wealth
- Income, tax, ownership or other financial details held outside an account.
- Order history
- What the person bought and when.
- Messages
- Private messages or support tickets.
- IP address
- IP address or device identifiers.
- Credentials
- Passwords, password hashes, seeds or 2FA secrets.
- Employment
- Employer, job title or HR records.
What followed
Aftermath
- Sale
- Offered for sale.
- Publication
- Published or dumped.
- Extortion
- A ransom or extortion demand to the holder or to the people in the data.
- Phishing
- Phishing or scam attempts that used the data.
- Impersonation
- The holder or its staff were impersonated to the people in the data.
- Physical threat
- Threats of a visit or of violence that used the data.
- Physical attack
- A documented attack on a person that used the data.
A personal risk management app and private advisory for founders, executives, investors and their families. Built by people working in cryptography, digital and physical security and continuity of operations.