Have I Been Pwned loads 559,908 email addresses from Crunchbase data published after a January 2026 ShinyHunters 'pay or leak' extortion attempt; names, phone numbers, employers, job titles and LinkedIn profiles also exposed
Have I Been Pwned added Crunchbase on 14 October 2026 (06:01 UTC; 14:01 Perth time). It says the private company intelligence platform was targeted in a ShinyHunters 'pay or leak' extortion attempt in January 2026, after which data allegedly taken from the company was published. HIBP counts 559,908 unique email addresses, mostly belonging to sales leads and business contacts, along with names, physical addresses, phone numbers, job titles, employers and social media (LinkedIn) profiles. Crunchbase later confirmed that a threat actor had exfiltrated documents from its corporate network. HIBP marks the breach as verified, with a breach date of 22 January 2026. Australian contacts are not separately stated. Primary: Have I Been Pwned; SecurityWeek covered Crunchbase's confirmation in January.
- Product
- Crunchbase (company intelligence platform) — business contact and sales lead records
- Versions
- n/a — incident
- Exploited in Australia?
- unknown
- Patch to
- Check your work address on Have I Been Pwned. Business contacts in the data should expect targeted phishing that uses their real name, employer and job title, and should confirm payment or account changes through a known phone number.
Primary: Have I Been Pwned — Crunchbase breach (added 14 Oct 2026 UTC; breach 22 Jan 2026) · SecurityWeek — Crunchbase confirms data breach after hacking claims (Jan 2026)