Malware log
Operation Endgame 2.0
15 436 844 addresses collected by malware, in a log dated 2025-05-23: not accounts taken from a breached service.
Breached2025-05-23Added to HIBP2025-05-23 UTCUpdated by HIBP2025-05-25 UTCAddresses15 436 844Domain—
VerifiedMalware
What happened in Have I Been Pwned’s words
In May 2025, a coalition of law enforcement agencies took down the criminal infrastructure behind the malware used to launch ransomware attacks in a new phase of "Operation Endgame". This followed the first Operation Endgame exercise a year earlier, with the latest action resulting in 15.3M victim email addresses being provided to HIBP by law enforcement. A further 43.8M victim passwords were also provided for HIBP's Pwned Passwords service.
Exposed data as HIBP classifies it
- Email addresses
- Passwords
How HIBP qualifies it
- HIBP verified that the data came from this service.
- Collected by malware rather than taken from the service.
HIBP names no domain for this breach.
Source: Have I Been Pwned (CC BY 4.0)
Copied from HIBP 2026-11-05 03:50 UTC