Atlas Menu data breach
63,926 accounts exposed in a breach on 30 May 2026. Passwords were included.
At a glance
63,926
Accounts exposed
30 May 2026
Date of the breach
30 May 2026
Added to the list
What happened
In May 2026, the GTA V and CS2 cheat service Atlas Menu suffered a data breach. An attacker claimed to have gained access to all Atlas systems and published the service's database to a public GitHub repository. The incident exposed 64k unique email addresses along with usernames, IP addresses, support tickets and passwords stored as bcrypt hashes.
What was exposed
- Email addresses. Email addresses were exposed. Expect more spam and phishing aimed at those addresses.
- IP addresses. Internet addresses were exposed. They show roughly where and how you connect. They cannot be used to log in.
- Passwords. Passwords were exposed. Anyone who holds them can try them on other accounts, so treat any account that used the same password as at risk.
- Support tickets. This kind of data was included in the breach. Treat it as exposed and be careful with messages that use it.
- Usernames. Usernames were exposed. Together with a reused password they open accounts.
What to do now
It depends on what was exposed, so these steps follow the list above.
If your password or sign-in details were exposed
- Change the password on the affected account now, and on every other account that used the same password.
- Use a password manager so each account has its own long, random password.
- Turn on two-step sign-in (multi-factor authentication) wherever it is offered, so a stolen password alone is not enough.
- If security questions were exposed, change them too, and treat the answers like passwords.
If your contact details were exposed
- Expect more spam, scam calls and phishing. Do not click links or open attachments in messages you did not expect.
- If a message mentions this breach, do not reply. Go to the organisation's own website or app instead of using a link in the message.
Whatever was exposed
- Check which other breaches include your own email address and phone number.
- Keep an eye on your accounts for a few months. Breached data is often used long after the breach.
- If you think someone is using your details, report it to the organisation and to your national cyber crime reporting service.
Check your own exposure
- Password leak check: find out whether a password has appeared in a breach. The password never leaves your browser.
- Free domain security scan: grade the email, DNS and website security of a domain you own.
Related breaches
Other breaches that exposed some of the same kinds of data.
Edmunds
In January 2026, the automotive research and car-shopping platform Edmunds was listed by the ShinyHunters hacking group as having been breached.
- Device information
- Email addresses
- IP addresses
- Passwords
- +2 more
Read what happened
Fanlore
In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates.
- Email addresses
- Names
- Passwords
- Usernames
Read what happened
Paidwork
In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale.
- Bank account numbers
- Dates of birth
- Device information
- Education levels
- +10 more
Read what happened