Have I Been Pwned Discovers 70 Million Stolen Credentials in Single Dataset

Nearly 71 million user details have been published online at once by a hacker forum user. The data is part of the so-called Naz.API dataset and comes from Facebook, eBay and Yahoo, among others.

About a third of the email addresses that ended up on the street as part of this dataset were not previously in the Have I Been Pwned database. states Troy Hunt, the founder of the data breach search engine. According to him, this amounts to a ‘significant amount of new data’. The captured data is said to largely come from stealer logs, or malware that steals login details from hacked computers.

However, Hunt also discovered that his own data is part of the dataset, and concludes that it is not only stealer logs, but also stolen data from hacked websites. However, in the latter case it appears to concern relatively old data; Hunt said he had not used the published password for more than ten years.

Although the founder cannot say with certainty that the email addresses and passwords in the dataset are legitimate, he says he has “high confidence” that the data is real based on the checks he has performed. It is not entirely clear from which sites the login details come, but based on a screenshot that Hunt shares, it certainly concerns Facebook, eBay, Yahoo and Roblox. According to Hunt, the email addresses and passwords have now been added to Have I Been Pwned.

Some credentials present in the Naz.API dataset