Loading story…
Proton has introduced the Data Breach Observatory, a new platform designed to identify and report on significant data breaches that may otherwise go unreported or undisclosed by affected organizations. The service, developed in partnership with Constella Intelligence, has already cataloged over 300 million compromised records from 794 incidents in 2025, focusing on breaches that target individual organizations rather than aggregated infostealer dumps. The Observatory aims to increase transparency around data breaches, particularly those impacting small and medium-sized businesses, and provides timely alerts to help individuals and organizations secure their accounts and prevent further harm.
The Data Breach Observatory excludes large-scale, aggregated datasets often found in infostealer dumps to maintain accuracy and relevance, instead highlighting breaches where sensitive information such as email addresses, passwords, and personal details are exposed. Proton's initiative addresses the lack of transparency in breach reporting and seeks to bolster cyber defenses by providing near real-time updates on newly discovered breaches, with a particular emphasis on sectors like retail, tech, and media that have been most frequently targeted. The service is positioned as a critical tool for organizations seeking to mitigate the risks associated with undisclosed data exposures.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Proton reported that when large aggregated datasets are included, the volume of leaked records available on the dark web rises to hundreds of billions across more than 1,500 breaches. It also said nearly half of tracked breaches affected small-to-midsize businesses, with retail and wholesale trade most frequently targeted.
At launch, Proton reported that its Observatory had identified 794 data breach incidents in 2025 affecting about 300 million records, excluding large aggregated infostealer dumps to avoid duplication and inflated totals. Proton also said passwords appeared in 49% of examined leaked datasets and sensitive government or healthcare data appeared in 34% of cases.
Proton launched the Data Breach Observatory, a platform designed to identify and publicize data breaches by monitoring dark web sources and validating findings with Constella Intelligence. Proton said it would update the service in near real time and contact affected organizations through responsible disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Have I Been Pwned (HIBP), the widely used data breach notification service, has indexed nearly 2 billion unique email addresses and 1.3 billion passwords from newly obtained datasets, marking the largest single update in the platform's history. The data, sourced in part from threat intelligence provider Synthient, includes both stealer log data—collected by malware from infected machines—and credential stuffing lists, which are typically compiled from previous breaches and used to facilitate unauthorized access to accounts across multiple services. This update brings the total number of accounts tracked by HIBP to over 15 billion, significantly expanding the visibility of exposed credentials for individuals and organizations. The newly indexed records include 183 million unique email addresses uploaded on October 21, as well as a much larger corpus totaling nearly 2 billion addresses and 1.3 billion passwords, 625 million of which were previously unseen. Users are encouraged to check their exposure using HIBP's free search tools and to take immediate action if their credentials are found, such as changing passwords and enabling multi-factor authentication. The scale and diversity of the data highlight the ongoing risks of password reuse and the importance of proactive credential management to mitigate the threat of account takeover attacks.
Jul 12, 2026
Prosper, a prominent peer-to-peer lending marketplace, suffered a significant data breach in September 2025, resulting in the exposure of sensitive personal information belonging to 17.6 million customers and loan applicants. The breach was detected on September 2, 2025, and was publicly disclosed by Prosper, which confirmed that unauthorized access to their systems had occurred. The compromised data includes a wide range of personally identifiable information such as names, email addresses, dates of birth, Social Security numbers, government-issued IDs, employment statuses, income levels, credit status information, physical addresses, IP addresses, and browser user agent details. Prosper stated that, despite the breach, there was no evidence that customer accounts or funds were accessed or compromised. The company’s customer-facing operations remained uninterrupted throughout the incident. Prosper has reported the breach to relevant authorities and is actively collaborating with law enforcement agencies to investigate the attack. The company is still determining the full scope of the data affected and has committed to providing free credit monitoring services to impacted individuals once the investigation clarifies the extent of the exposure. The breach was added to the Have I Been Pwned database on October 16, 2025, which helped reveal the scale of the incident, specifically the number of unique email addresses involved. Prosper has advised all users to change their passwords if they have not done so since the breach and to enable two-factor authentication for enhanced security. The company has also published a dedicated FAQ page to address customer concerns and provide ongoing updates. The attackers reportedly accessed the data through unauthorized queries on company databases that store customer and applicant information. Prosper emphasized that resolving the incident is a top priority and pledged to share additional information with customers as the investigation progresses. The breach has raised concerns about the security of financial services platforms and the protection of sensitive customer data. Security experts recommend that affected individuals monitor their credit reports and remain vigilant for signs of identity theft. The incident underscores the importance of robust cybersecurity measures and timely breach notification in the financial sector. Prosper’s response and transparency in handling the breach will be closely watched by regulators and customers alike. The breach has significant implications for the privacy and security of millions of individuals whose data was entrusted to the platform.
Jun 29, 2026
The **Identity Theft Resource Center (ITRC)** reported that U.S. data compromises (breaches, leaks, and accidental exposures) reached a new record in 2025, rising **4%** year-over-year to **3,332** incidents—an increase of **79%** over five years and the third consecutive year exceeding 3,000 events. Despite the higher incident count, the number of affected individuals fell sharply to **278.8 million** (down from **1.36 billion** in 2024), which was attributed to the relative absence of **“mega breaches”** that have driven outsized victim totals in prior years. Consumer impact indicators remained negative: an ITRC poll cited widespread breach-notice exposure (most respondents receiving at least one notice) and reported downstream harms including **account takeover** and increased **phishing/spam**, alongside “breach fatigue” reducing follow-on protective actions. Separately, *Hackmageddon* continued its annual tracking of **mega breaches** (defined as incidents involving **>1 million records**) for 2026, reinforcing that large-scale events are monitored as a distinct category that can disproportionately influence annual victim counts even when overall incident volume trends upward.
Jun 29, 2026