What is the Data Breach Observatory?

The Data Breach Observatory is a project operated and maintained by Proton AG [/] to document cybersecurity incidents affecting small businesses. It's similar to our Internet Censorship Observatory(new window) [https://protonvpn.com/internet-censorship-observatory], which provides information about the latest attacks on internet freedom.

We look out for breaches that include names, email addresses, passwords, financial information, contact details, and other sensitive information. Financial information could include credit cards, bank account details, payment information, tax IDs, and/or Social Security numbers. Contact information includes phone numbers, addresses, location data, and postal codes. Sensitive information could include other vital details like date of birth, ID numbers, passport numbers, license numbers, and health information.

Why report data breach news?

Data breaches are extremely common and extremely under-reported. This creates a dangerous situation for small business owners, who are both at high risk and unaware of the threats they face. By responsibly disclosing breaches and raising awareness, the Data Breach Observatory aims to give consumers and small business owners the tools and information they need to protect themselves.

Where do you get your information?

In partnership with Constella Intelligence, we constantly monitor for new data leaked by criminals to the dark web. This helps us protect our customers through features like Pass Monitor [/pass/pass-monitor] in Proton Pass. By analyzing these same dark web databases, we can also produce original, timely research about new data breaches.

Doesn't disclosing recent data breaches harm the businesses?

We believe in responsible disclosure, and we always inform the affected organization in advance of the information being published in the Data Breach Observatory. To help these organizations protect themselves in the future, Proton offers discounts for Proton Pass business plans [/business/pass/pricing].

Data Breach Observatory

Scouring the dark web for leaks of sensitive data

Four in five small businesses have suffered a recent data breach. And a single incident can cost a small firm over $1 million. So why don't we hear more data breach news?

Proton isn’t waiting for breaches to be reported. Instead, we go directly to the dark web, capturing and sharing leaks in real time — and helping small businesses to protect themselves.

See the latest data breaches Download full list

Publication date: October, 11, 2025

Qantas Airways

What happened?

Australia's national airline Qantas Airways Ltd. was targeted by a group of hackers named Scattered Lapsus$ Hunters which launched a ransomware attack(new window). The company did not pay the ransom, leading to more than 11 million customer records being leaked on the dark web. Sensitive data including customer names, addresses, and email addresses were exposed, but no financial records appeared. Qantas announced that it has strengthened its security measures following the data breach.

Back to list

Publication date: September 23, 2025

Allianz Life

What happened?

In July 2025, hackers targeted the world's largest insurance company and Europe's largest financial services company Allianz(new window) and subsequently stole the personal information of 1 million Allianz customers and employees. Subsequently, information including names, dates of birth, physical addresses, phone numbers, email addresses, and Social Security numbers appeared in a data breach. The breach affected North American customers and employees, and Allianz disclosed the data breach in a legal filing in the US state of Maine.

Back to list

Publication date: September, 9, 2025

Tracelo

What happened?

In September 2024, the data of more than 1.4 million customers(new window) of the mobile geolocation tracking service Tracelo was leaked on the dark web. A hacker known as Satanic leaked customer names, addresses, phone numbers, email addresses, and passwords following an attack on Tracelo, posting them on the cybercrime forum BreachForums. Tracelo does not appear to have addressed the breach.

Back to list

Publication date: June, 4, 2025

INTERSPORT France

What happened?

In France, more than 100,000 customers of sporting goods retailer INTERSPORT(new window) had their personal data leaked on BreachForums. Data including names, addresses, phone numbers, and email addresses appeared online in June 2025. INTERSPORT advised that it was addressing the breach, but did not disclose whether it had notified French authorities of the breach.

Back to list

Publication date: May, 27, 2025

Free

What happened?

France's second largest ISP and telephone provider Free(new window) confirmed in October 2024 that it had been targeted by a data breach. In May 2025, customer data appeared on the dark web: names, dates of birth, phone numbers, email addresses, and IBANs were all leaked. In total, more than 19.5 million records appeared online. The National Commission for Information Technology and Freedoms launched a sanctions procedure against Free in March 2025.

Back to list

Publication date: February, 24, 2025

Orange Romania

What happened?

In February 2025, a hacker going by the name Rey obtained more than 3.4 million records from telecoms provider Orange's Romanian branch(new window). Data including customer names, dates of birth, addresses, phone numbers, email addresses, usernames, and ID numbers appeared on the dark web following a ransomware attack which Orange declined to pay. Orange is monitoring the attack along with The Romanian National Cybersecurity Directorate (DNSC).

Back to list

Publication date: February, 18, 2025

Zacks Investment Research

What happened?

Chicago-based investment research company Zacks Investment Research(new window) was breached by hackers in June 2024. In February 2025, customer data including names, addresses, phone numbers, email addresses, usernames, and passwords appeared for sale online. The company has not yet addressed this breach, having now been affected by multiple data breaches in recent years.

Back to list

Publication date: February, 2, 2025

SkilloVilla

What happened?

Back to list

Publication date: January, 7, 2025

amai

What happened?

More than 10 million records stolen from Singapore-based eCommerce platform Amai appeared on the dark web in January 2025. Names, addresses, phone numbers, email addresses, and passwords were stolen from the company's customer database. It does not appear that Amai has acknowledged a data breach as of October 2025.

Back to list

Publication date: January, 6, 2025

PhoneMondo

What happened?

In January 2025, more than 10.5 million records stolen from German telecommunications platform PhoneMondo appeared on the dark web. Sensitive data includes names, dates of birth, addresses, phone numbers, email addresses, usernames, passwords, and IBANs. As of October 2025, it doesn't appear that PhoneMondo has acknowledged the breach.

Back to list

Keep your business off this list

Your passwords and multi-factor authentication are your first line of defense against hackers. Learn how thousands of small business leaders streamline password management and protect their data.

Explore solutions

About the Data Breach Observatory

What is the Data Breach Observatory?: The Data Breach Observatory is a project operated and maintained by Proton AG to document cybersecurity incidents affecting small businesses. It's similar to our Internet Censorship Observatory(new window), which provides information about the latest attacks on internet freedom.
What data is leaked?: We look out for breaches that include names, email addresses, passwords, financial information, contact details, and other sensitive information. Financial information could include credit cards, bank account details, payment information, tax IDs, and/or Social Security numbers. Contact information includes phone numbers, addresses, location data, and postal codes. Sensitive information could include other vital details like date of birth, ID numbers, passport numbers, license numbers, and health information.
Why report data breach news?: Data breaches are extremely common and extremely under-reported. This creates a dangerous situation for small business owners, who are both at high risk and unaware of the threats they face. By responsibly disclosing breaches and raising awareness, the Data Breach Observatory aims to give consumers and small business owners the tools and information they need to protect themselves.
Where do you get your information?: In partnership with Constella Intelligence, we constantly monitor for new data leaked by criminals to the dark web. This helps us protect our customers through features like Pass Monitor in Proton Pass. By analyzing these same dark web databases, we can also produce original, timely research about new data breaches.
Doesn't disclosing recent data breaches harm the businesses?: We believe in responsible disclosure, and we always inform the affected organization in advance of the information being published in the Data Breach Observatory. To help these organizations protect themselves in the future, Proton offers discounts for Proton Pass business plans.