Fanlore data breach
144,520 accounts exposed in a breach on 6 August 2026. Passwords were included.
At a glance
144,520
Accounts exposed
6 August 2026
Date of the breach
19 August 2026
Added to the list
What happened
In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates. The breach resulted in the exposure of 145k unique email addresses along with usernames and passwords stored as either MD5 or PBKDF2 hashes. OTW self-submitted the exposed data to HIBP.
What was exposed
- Email addresses. Email addresses were exposed. Expect more spam and phishing aimed at those addresses.
- Names. Names were exposed. Scammers use real names to make a message look personal.
- Passwords. Passwords were exposed. Anyone who holds them can try them on other accounts, so treat any account that used the same password as at risk.
- Usernames. Usernames were exposed. Together with a reused password they open accounts.
What to do now
It depends on what was exposed, so these steps follow the list above.
If your password or sign-in details were exposed
- Change the password on the affected account now, and on every other account that used the same password.
- Use a password manager so each account has its own long, random password.
- Turn on two-step sign-in (multi-factor authentication) wherever it is offered, so a stolen password alone is not enough.
- If security questions were exposed, change them too, and treat the answers like passwords.
If your contact details were exposed
- Expect more spam, scam calls and phishing. Do not click links or open attachments in messages you did not expect.
- If a message mentions this breach, do not reply. Go to the organisation's own website or app instead of using a link in the message.
Whatever was exposed
- Check which other breaches include your own email address and phone number.
- Keep an eye on your accounts for a few months. Breached data is often used long after the breach.
- If you think someone is using your details, report it to the organisation and to your national cyber crime reporting service.
Check your own exposure
- Password leak check: find out whether a password has appeared in a breach. The password never leaves your browser.
- Free domain security scan: grade the email, DNS and website security of a domain you own.
Related breaches
Other breaches that exposed some of the same kinds of data.
Double Counter
In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool.
- Email addresses
- Geographic locations
- Names
- Usernames
Read what happened
Chess.com (2026)
In August 2026, millions of records allegedly sourced from Chess.com were posted online.
- Email addresses
- Geographic locations
- Names
- Usernames
Read what happened
Golf Canada
In mid-2026, hundreds of thousands of user records allegedly sourced from Golf Canada began circulating via Telegram.
- Dates of birth
- Email addresses
- Genders
- Geographic locations
- +2 more
Read what happened