Addi data breach: 34.5M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-05-18
In March 2026, the Colombian fintech company Addi identified unauthorised activity on its platform and advised customers that "it is possible that your personal information may have been compromised". The "pay or leak" extortion group ShinyHunters subsequently claimed responsibility and published a large trove of personal data allegedly obtained from Addi. The data included 34M unique email addresses from credit scoring requests, credit bureau records, customer identity records and email validation logs. It also contained government issued IDs (Cédula de Ciudadanía), estimated income, socioeconomic levels, purchases and other credit-related data points. Exposed data: age groups, credit scores, device information, email addresses, government issued ids, income levels, ip addresses, latitude and longitude pairs, names, phone numbers, physical addresses, purchases, socioeconomic levels. The breach dates from Mar 25, 2026; Have I Been Pwned loaded it on May 18, 2026.
What to do
- If you had a Addi account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
