Addi
Disclosed May 18, 20264 months ago34,532,941 accountsUnverified
In March 2026, the Colombian fintech company Addi identified unauthorised activity on its platform and advised customers that "it is possible that your personal information may have been compromised". The "pay or leak" extortion group ShinyHunters subsequently claimed responsibility and published a large trove of personal data allegedly obtained from Addi. The data included 34M unique email addresses from credit scoring requests, credit bureau records, customer identity records and email validation logs. It also contained government issued IDs (Cédula de Ciudadanía), estimated income, socioeco
What is known
| People affected | 34,532,941 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | May 18, 2026 |
| Happened | Mar 25, 2026 |
| Attack | Extortion |
| Data exposed | Emails, Government IDs, Financial, IP addresses, Names, Phone numbers, Addresses |
| Sector | Tech |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| Have I Been Pwned: Addihaveibeenpwned.com · Aggregator | Aggregator |
Notices filed
| Where | Filed | People |
|---|---|---|
| Have I Been Pwnedaccounts in the data | May 18 | 34,532,941 |
History of this record
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Have I Been Pwned). Record counts are as reported. Not legal advice.