Synthient Stealer Log Threat Data data breach: 183.0M accounts exposed
Severity: critical · Patch status: no-fix-needed · Since 2025-10-21
During 2025, Synthient aggregated billions of records of "threat data" from various internet sources. The data contained 183M unique email addresses alongside the websites they were entered into and the passwords used. After normalising and deduplicating the data, 183 million unique email addresses remained, each linked to the website where the credentials were captured, and the password used. This dataset is now searchable in HIBP by email address, password, domain, and the site on which the credentials were entered. Exposed data: email addresses, passwords. The breach dates from Apr 11, 2025; Have I Been Pwned loaded it on Oct 21, 2025.
What to do
- If you had a Synthient Stealer Log Threat Data account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
