TheSqua.re data breach: 107K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2025-08-27
In June 2025, 107k unique customer email addresses were allegedly obtained from TheSqua.re, the "easiest way to find your next serviced apartment". The data also included names, phone numbers and cities which were subsequently posted to a popular hacking forum. TheSqua.re did not respond to repeated attempts to disclose the incident, however multiple impacted HIBP subscribers confirmed the legitimacy and accuracy of the data. Exposed data: email addresses, geographic locations, names, phone numbers. The breach dates from Jun 27, 2025; Have I Been Pwned loaded it on Aug 27, 2025.
What to do
- If you had a TheSqua.re account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch