Loading story…
Two large spam-related datasets, Special K Data Feed and SC Daily Phone, were added to Have I Been Pwned after exposing personal information tied to nearly 64 million identities in total. The records surfaced from 2015-era spam list activity and appear to have been compiled for use in unsolicited marketing or spam operations rather than from a single corporate intrusion.
The exposed data in both lists included names, physical addresses, IP addresses, genders, birth dates, and phone numbers, creating a broad privacy risk for affected individuals. Special K Data Feed contained nearly 31 million identities, while SC Daily Phone exposed nearly 33 million, highlighting how large-scale spam ecosystems can aggregate and circulate detailed personally identifiable information for abuse.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
In mid to late 2015, the Special K Data Feed spam list was discovered, containing nearly 31 million identities. The exposed data included names, physical addresses, IP addresses, genders, birth dates, and phone numbers, and appears to have been used in spam operations.
In early 2015, a spam list identified as SC Daily Phone emerged, exposing nearly 33 million identities. The dataset reportedly included names, physical addresses, IP addresses, genders, birth dates, and phone numbers.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The consumer spyware services **Cocospy** and **Spyzie** suffered breaches that exposed large volumes of customer data and reportedly opened access to highly sensitive information collected from monitored devices. According to breach disclosures added to **Have I Been Pwned**, the Cocospy incident exposed nearly **1.8 million** customer email addresses, while the Spyzie breach exposed about **519,000** email addresses; related spyware service **Spyic** was also reported as affected. The compromised data reportedly included not only customer records but also victim information gathered by the spyware platforms, including captured messages, photos, and call logs. Because of the sensitivity of the incident, the exposed email addresses were provided to HIBP but were classified as **sensitive**, meaning they are not publicly searchable through the service.
Jun 29, 2026
Have I Been Pwned (HIBP), the widely used data breach notification service, has indexed nearly 2 billion unique email addresses and 1.3 billion passwords from newly obtained datasets, marking the largest single update in the platform's history. The data, sourced in part from threat intelligence provider Synthient, includes both stealer log data—collected by malware from infected machines—and credential stuffing lists, which are typically compiled from previous breaches and used to facilitate unauthorized access to accounts across multiple services. This update brings the total number of accounts tracked by HIBP to over 15 billion, significantly expanding the visibility of exposed credentials for individuals and organizations. The newly indexed records include 183 million unique email addresses uploaded on October 21, as well as a much larger corpus totaling nearly 2 billion addresses and 1.3 billion passwords, 625 million of which were previously unseen. Users are encouraged to check their exposure using HIBP's free search tools and to take immediate action if their credentials are found, such as changing passwords and enabling multi-factor authentication. The scale and diversity of the data highlight the ongoing risks of password reuse and the importance of proactive credential management to mitigate the threat of account takeover attacks.
Jul 12, 2026
Customer and marketing data from Australian retailer **digiDirect** and New Zealand media company **MediaWorks** was exposed after separate datasets were posted to a popular hacking forum. The digiDirect breach, published in September 2024, contained more than **300,000** rows of personal information, including names, email addresses, physical addresses, phone numbers, and dates of birth. About half of the email addresses were tied to external marketplace domains such as **Amazon**, **eBay**, and **Westfield**, suggesting some affected records may have come from third-party marketplace activity. MediaWorks suffered a larger exposure after a dataset was publicly posted in March 2024 containing millions of rows and **163,000 unique email addresses** linked to people who entered online competitions. The leaked records included names, physical addresses, phone numbers, dates of birth, genders, and competition responses. Following the leak, some victims reportedly received ransom demands seeking payment in exchange for deletion of their stolen data, underscoring the downstream extortion risk created by publicly traded personal data.
Jun 29, 2026