183 million plaintext credentials added to Have I Been Pwned breach

A database containing 183 million email addresses and corresponding passwords from an April 2025 collection was added to the Have I Been Pwned breach repository on October 21, security researcher Troy Hunt confirmed. The data, compiled by a threat intelligence aggregator and drawn mainly from infostealer logs and credential-stuffing lists, includes site addresses, email addresses and plaintext passwords, and has been made searchable on the Have I Been Pwned site so users can check whether their accounts appear in the set.

The dataset originated with a platform that aggregated threat data from multiple online sources into a 3.5 terabyte file comprising roughly 23 billion rows. Hunt said he cleaned and normalized the material, removing duplicate and inconsistent entries, and produced a final set of 183 million unique email addresses for inclusion in the repository. Have I Been Pwned now lists more than 15.3 billion affected accounts across hundreds of breaches. An analysis of a sample of about 94,000 records found that the large majority had appeared in prior collections, but Hunt’s work also identified roughly 16.4 million email addresses that did not appear in previous breach...