MyHeritage

Disclosed Jun 15, 201891,991,358 accountsConfirmed

In October 2017, the genealogy website MyHeritage suffered a data breach . The incident was reported 7 months later after a security researcher discovered the data and contacted MyHeritage. In total, more than 92M customer records were exposed and included email addresses and salted SHA-1 password hashes. In 2019, the data appeared listed for sale on a dark web marketplace (along with several other large breaches) and subsequently began circulating more broadly.

What is known

People affected	91,991,358 (accounts in the leaked data, per Have I Been Pwned)
Disclosed	Jun 15, 2018
Happened	Oct 26, 2017
Attack	Not stated
Data exposed	NamesCredentials and tokensEmailsPasswords
Sector	Tech · US
Status	Confirmed
Check your email	Have I Been Pwned

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: MyHeritage

Official noticeattorneygeneral.delaware.gov

Notice letter filed with the Delaware DOJ: MyHeritage

Aggregatorhaveibeenpwned.com

Have I Been Pwned: MyHeritage

Notices filed

Residents of CAJun 15, 2018

California AGCount not stated

Residents of DEJun 15, 2018

Delaware DOJCount not stated

Accounts in the dataFeb 20, 2019

Have I Been Pwned91,991,358 people

History of this record

hibp2026-09-25

empty to MyHeritageby backfillSource

sector2026-09-25

other to techby backfillSource

data_types2026-09-25

["names","credentials"] to ["names","credentials","emails","passwords"]by backfillSource

records_basis2026-09-25

empty to hibpby backfillSource

records2026-09-25

empty to 91991358by backfillSource

summary2026-09-25

empty to In October 2017, the genealogy website MyHeritage suffered a data breach . The incident was reported 7 months later after a security researcher discovered the data and contacted MyHeritage. In total, more than 92M customer records were expoby backfillSource

data_types2026-09-25

[] to ["names","credentials"]by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about MyHeritage