In January 2019, security researchers identified a massive compilation of previously breached credentials — known as Collection #1 — circulating on a popular hacker forum. The dataset contained approximately 773 million unique email addresses and 21 million unique plaintext passwords aggregated from more than 2,000 earlier data breaches. This was not a new breach of a single organisation but a curated, deduplicated compilation of years of prior incidents assembled for credential-stuffing use.
Yes. Collection #1 was breached in January 2019, exposing 772,904,991 records including email addresses, passwords. If your email was involved, your data may still be at risk today. Check if you were affected.
What happened in the Collection #1 data breach?
In January 2019, security researchers identified a massive compilation of previously breached credentials — known as Collection #1 — circulating on a popular hacker forum. The dataset contained approximately 773 million unique email addresses and 21 million unique plaintext passwords aggregated from more than 2,000 earlier data breaches. This was not a new breach of a single organisation but a curated, deduplicated compilation of years of prior incidents assembled for credential-stuffing use.
Collection #1 was notable for its plaintext passwords — unlike breach databases that contain only hashed values, a portion of the credentials had already been cracked or had been taken from services that stored passwords improperly. The ready-to-use format gave attackers a high-efficiency toolkit for testing against popular websites. Any email address in the collection had already survived real-world credential-stuffing attempts, making it a verified active target.
Security researcher Troy Hunt, who analysed the dataset in depth, noted that approximately 140 million email addresses and 10 million passwords in Collection #1 were entirely new — meaning they had never appeared in any previously known breach and likely originated from smaller, unreported incidents.
Learn more about what a data breach means for you.
Why was the Collection #1 breach so dangerous?
Collection #1 was notable for its plaintext passwords — unlike breach databases that contain only hashed values, a portion of the credentials had already been cracked or had been taken from services that stored passwords improperly. The ready-to-use format gave attackers a high-efficiency toolkit for testing against popular websites. Any email address in the collection had already survived real-world credential-stuffing attempts, making it a verified active target.
Collection #1 credentials were "live" at the time of compilation — meaning they had been verified as working credentials on real services. Users who have not changed the exposed password since their original source breach still have active credentials in this dataset. The collection remains actively traded and used in credential-stuffing automation in 2026.check if your email was exposed in this breach.
What data was stolen in the Collection #1 breach?
Email addresses Passwords
Email addresses — used for phishing attacks and credential stuffing against your other accounts
Passwords — can be used to access your accounts directly or cracked to reveal your actual password
Timeline of the Collection #1 breach
2014–2018
Credentials from hundreds of separate breaches compiled and traded in underground markets
January 2019
Collection #1 appears on a popular hacker forum — approximately 87 GB of data
January 2019
Security researcher Troy Hunt analyses the dataset and publishes findings
January 2019
Affected email addresses added to public breach notification database
Is the Collection #1 breach still dangerous in 2026?
Collection #1 credentials were "live" at the time of compilation — meaning they had been verified as working credentials on real services. Users who have not changed the exposed password since their original source breach still have active credentials in this dataset. The collection remains actively traded and used in credential-stuffing automation in 2026.
Personal information like email addresses, phone numbers, and dates of birth does not expire. Even if you changed your Collection #1 password, the other exposed data can be combined with information from other breaches to target you.
Learn how long stolen data stays dangerous.
What to do if your email was in the Collection #1 breach
1
Change your Collection #1 password immediately
Log into Collection #1 and change your password to something strong and unique — one you have never used anywhere else.
2
Change any account sharing that password
If you reused this password elsewhere, change it on every affected account. Attackers test stolen credentials against hundreds of popular sites within hours.
3
Enable two-factor authentication
Turn on 2FA on Collection #1 and every important account. Even if your password is known, attackers cannot access the account without the second factor.
4
Check your other accounts for this breach
Run a full email scan to see every breach your address appears in — not just this one.
Collection #1 is a 773-million-record compilation of email addresses and plaintext passwords assembled from more than 2,000 separate data breaches. It was not a single hack of one company but an aggregation of years of prior incidents packaged for credential-stuffing attacks.
Which of my accounts might be at risk from Collection #1?
Any service where you used an email and password combination that appeared in one of the source breaches. Because the dataset includes plaintext passwords, those credentials can be tested against other services immediately without cracking. Services like email, banking, and subscription platforms are the most common targets.
My email appears in Collection #1 but not in any specific breach — what does that mean?
It means your credentials came from a smaller, unreported breach that was never independently documented. You were still affected — your email and password were circulating in criminal markets even if the original source was never publicly identified.
Is Collection #1 still dangerous in 2026?
Yes. Credentials that have not been changed since the source breach are still valid. Collection #1 is widely distributed and has been incorporated into many downstream credential-stuffing toolkits. The dataset does not expire — it remains a reference that attackers consult years after its initial publication.
How this breach page is reviewed
Breach pages are built from structured breach records and reviewed for practical risk guidance by EmailLeaked. Risk labels reflect exposed data types and are intended to help readers prioritise action.