Loading story…
The Russian instant messaging service QIP suffered a major data breach in 2011 that exposed tens of millions of user accounts. Reporting on the incident indicates that between 26 million and more than 33 million accounts were affected, with compromised records including email addresses and passwords tied to the service.
Although the intrusion occurred years earlier, the stolen data did not become widely available immediately and surfaced publicly later, drawing renewed attention to the scale of the compromise. The exposure added QIP to the list of legacy breaches in which old credential datasets re-emerged online, increasing the risk of account takeover and password reuse abuse for affected users.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
The data stolen in the QIP breach did not become broadly public immediately after the intrusion. By September 2016, reporting indicated the old breach data had surfaced publicly.
In mid-2011, the Russian instant messaging service QIP experienced a data breach. The incident exposed more than 26 million user accounts, with reports citing over 33 million compromised accounts including email addresses and passwords.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Have I Been Pwned (HIBP), the widely used data breach notification service, has indexed nearly 2 billion unique email addresses and 1.3 billion passwords from newly obtained datasets, marking the largest single update in the platform's history. The data, sourced in part from threat intelligence provider Synthient, includes both stealer log data—collected by malware from infected machines—and credential stuffing lists, which are typically compiled from previous breaches and used to facilitate unauthorized access to accounts across multiple services. This update brings the total number of accounts tracked by HIBP to over 15 billion, significantly expanding the visibility of exposed credentials for individuals and organizations. The newly indexed records include 183 million unique email addresses uploaded on October 21, as well as a much larger corpus totaling nearly 2 billion addresses and 1.3 billion passwords, 625 million of which were previously unseen. Users are encouraged to check their exposure using HIBP's free search tools and to take immediate action if their credentials are found, such as changing passwords and enabling multi-factor authentication. The scale and diversity of the data highlight the ongoing risks of password reuse and the importance of proactive credential management to mitigate the threat of account takeover attacks.
Jul 12, 2026
The consumer spyware services **Cocospy** and **Spyzie** suffered breaches that exposed large volumes of customer data and reportedly opened access to highly sensitive information collected from monitored devices. According to breach disclosures added to **Have I Been Pwned**, the Cocospy incident exposed nearly **1.8 million** customer email addresses, while the Spyzie breach exposed about **519,000** email addresses; related spyware service **Spyic** was also reported as affected. The compromised data reportedly included not only customer records but also victim information gathered by the spyware platforms, including captured messages, photos, and call logs. Because of the sensitivity of the incident, the exposed email addresses were provided to HIBP but were classified as **sensitive**, meaning they are not publicly searchable through the service.
Jun 29, 2026
Flash Flash Revolution, a music-based rhythm game, suffered two major account compromises that together exposed data from roughly **3.7 million** records. In the February 2016 incident, attackers breached the site's **vBulletin forum** and exposed about **1.8 million accounts**, including email addresses, IP addresses, and **salted MD5 password hashes**. A separate breach in July 2019 affected nearly **1.9 million members** and was disclosed as distinct from the earlier compromise. The later incident exposed email addresses, IP addresses, usernames, dates of birth, and **salted MD5 password hashes**, extending the scope of personal data tied to the platform and creating renewed credential and privacy risks for affected users.
Jun 29, 2026