4.35M accounts from Operation Endgame 4.0 were exposed in this breach. Besides email addresses, it included passwords, which makes it a high-risk breach.
Was your email address in this breach?
We display where your address leaked and what went with it. We never store the address.
We don't store your address. It is checked right here against about 1029 breaches, including this one.
Email addressesPasswords
On 18 June 2026, the latest phase of Operation Endgame targeted the SocGholish malware operation, a prolific malware distribution network used to compromise systems and facilitate further cybercrime. Coordinated by international law enforcement agencies with support from Europol and Eurojust, the operation remediated almost 15,000 compromised websites and disrupted more than 100 servers and domains used to distribute malware. Authorities initially provided HIBP with 154k impacted email addresses and more than half a million previously unseen passwords. The following week, a further 4M email addresses and 9M passwords relating to the StealC malware operation also targeted by Operation Endgame were provided, followed by another 131k email addresses the following month, bringing the total to more than 4.3M unique email addresses.
Source: Have I Been Pwned (CC BY 4.0)