Ualabee data breach: 472K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2025-06-13
In May 2025, the South American mobility services platform Ualabee had hundreds of thousands of records scraped from an interface on their platform. The data included 472k unique email addresses along with names, profile photos, dates of birth and phone numbers. Exposed data: dates of birth, email addresses, names, phone numbers, profile photos. The breach dates from May 6, 2025; Have I Been Pwned loaded it on Jun 13, 2025.
What to do
- If you had a Ualabee account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch