DESCRIPTION LAST UPDATED: 2025-11-27
DEFAULT SEVERITY LEVEL: CRITICAL
This report is a list of compromised accounts we or our collaborative partners have uncovered (i.e. for which we believe attackers have obtained the credentials).
These accounts may have been compromised through a malware infection, site breach, phishing or other types of malicious activities.
This is currently not in the form of a daily report, but is sent as a one-off report run whenever we obtain access to new lists of compromised accounts.
On 2025-11-26, a report was shared with e-mail address related to findings described by watchTowr in https://labs.watchtowr.com/stop-putting-your-passwords-into-random-websites-yes-seriously-you-are-the-problem/. These have been tagged jsonformatter-codebeautify-leak and severity set to CRITICAL (10,449 entries shared).
On 2023-08-30, the report contained e-mail addresses that were obtained as part of the Qakbot botnet disruption by the FBI and international law enforcement partners.
You can learn more on our reports in general in our Overview of Free Public Benefit Shadowserver Reports presentation, which also explains example Use Cases.
Severity levels are described here.
Filename(s): compromised_account