Data breach
Addiaddi.com
34 532 941 accounts exposed in a breach dated 2026-03-25.
Breached2026-03-25Added to HIBP2026-05-18 UTCUpdated by HIBP2026-05-18 UTCAccounts34 532 941Domainaddi.com
Verified
What happened in Have I Been Pwned’s words
In March 2026, the Colombian fintech company Addi identified unauthorised activity on its platform and advised customers that "it is possible that your personal information may have been compromised". The "pay or leak" extortion group ShinyHunters subsequently claimed responsibility and published a large trove of personal data allegedly obtained from Addi. The data included 34M unique email addresses from credit scoring requests, credit bureau records, customer identity records and email validation logs. It also contained government issued IDs (Cédula de Ciudadanía), estimated income, socioeconomic levels, purchases and other credit-related data points.
Exposed data as HIBP classifies it
- Age groups
- Credit scores
- Device information
- Email addresses
- Government issued IDs
- Income levels
- IP addresses
- Latitude and longitude pairs
- Names
- Phone numbers
- Physical addresses
- Purchases
- Socioeconomic levels
How HIBP qualifies it
- HIBP verified that the data came from this service.