Data breach
WeLeakInfo data breach
11,788 accounts · breached March 8, 2021
Have I Been Pwned treats this breach as sensitive: it does not reveal publicly whether a particular address is in it. Only the owner of an address can check, after verifying it.
What happened
In March 2021, the Stripe account of the now-defunct WeLeakInfo service was taken over by "pompompurin" after acquiring an expired domain name with an email address used to manage the account. Access to Stripe then exposed almost 12k unique email addresses from customers who'd made credit card payments in order to obtain breached data hosted by WeLeakInfo. The data was subsequently leaked publicly and also included names, payment histories, IP addresses, billing addresses, partial credit card data and the organisation making the purchase.
What data leaked
- Browser user agent details
- Email addresses
- Employers
- IP addresses
- Names
- Partial credit card data
- Physical addresses
- Purchases
What to do if you had an account
- Turn on two-step sign-in. Enable two-factor authentication where the service offers it, preferably with an authenticator app or a passkey. A leaked password alone is then not enough to get in.
- Expect targeted phishing. Leaked contact details are used to write convincing fake messages that mention the breached company or your real name. Do not click links in unexpected emails or texts about this account; go to the site by typing its address.
- Check your bank statements. Review recent card and account transactions and report anything you do not recognise. If full card numbers were exposed, ask your bank to replace the card.
Check your email at haveibeenpwned.com
We do not run email lookups ourselves. The search is done on haveibeenpwned.com, the service this list comes from.