A Crunchbase data breach Have I Been Pwned entry has put 559,908 email addresses into a searchable public database. According to TechNadu's reporting, the data was added to the breach notification service on October 14, 2026, and the addresses largely belong to leads and business contacts. The listing follows a January 2026 "pay or leak" extortion attempt by the ShinyHunters group.
If you have ever signed up for Crunchbase, been entered into its sales pipeline, or exchanged emails with someone who works there, it is worth a quick check.
What Was Leaked and How ShinyHunters Got Here
Crunchbase is a private company known for its database of business and startup information. According to the report, the 559,908 email addresses now in Have I Been Pwned (HIBP) mostly belong to leads and business contacts, not to ordinary consumer accounts. HIBP also lists additional data types in its entry for the incident. The excerpt we reviewed does not spell out every field, so the HIBP listing itself is the best place to see exactly what was exposed.
The timeline matters. In January 2026, ShinyHunters targeted Crunchbase with what the report calls a "pay or leak" extortion attempt. The group said the data it allegedly obtained amounted to more than 2 million records. The October listing suggests the dispute ended with the data circulating, though the report excerpt does not detail how or where it was released.
Note the gap between the figures. The 559,908 addresses in HIBP are not the same as the group's claim of over 2 million records. Records and unique email addresses are different things, and HIBP's count reflects what was loaded into its database. Extortion groups often make large claims, so treat the numbers as separate until more detail emerges.
This is a familiar pattern. Our coverage of how the Gentlemen ransomware group listed MoneyGram, Deloitte, and KFC claims shows how ransom deadlines and public claims are used as pressure, and why the absence or presence of data samples matters when judging whether a claim is real.
How to Check If Your Email Is in Have I Been Pwned
Checking takes less than a minute:
- Go to the Have I Been Pwned website and enter your email address in the search box.
- Review the list of breaches that appear. If Crunchbase is among them, your address was in the leaked data.
- Open the Crunchbase entry to see which data types were exposed alongside your address.
- Repeat the search for every address you use, especially work addresses and older ones from past jobs.
One detail many people miss: because this leak is made up largely of business contacts, your work email is more likely to appear than a personal one. Check both. You can also use HIBP's notification feature so you are alerted if your address shows up in future breaches.
A clean result is not a guarantee of safety. HIBP only covers breaches that have been loaded into it, so it is a useful signal, not a complete audit of your exposure.
Why Exposed Business Contacts Face Targeted Phishing
A leaked list of business contacts is valuable to attackers for a specific reason: it tells them who works where and who might be a sales lead, buyer, or decision-maker. That context makes scams more convincing than generic spam.
Expect messages that reference your role, your industry, or a plausible vendor relationship. An email that appears to come from a data provider, a prospective client, or a finance contact is more likely to be opened when the sender seems to know your business. Emails that urge you to "verify your account," open an invoice, or move a conversation to another channel deserve extra suspicion.
The second risk is credential stuffing. If any exposed data includes passwords, or if you reused a Crunchbase password elsewhere, attackers can try the same email and password combination across other services. Reused passwords turn a single breach into many.
Extortion crews are also tied into a broader criminal ecosystem. Recent law-enforcement activity, such as the seizure of hacking platforms and the transfer of a ransomware suspect to Germany, shows that pressure on this world is growing, but leaked data tends to keep circulating long after the original group is disrupted.
What This Means For You
If your address is in the Crunchbase data, your email on its own is not a catastrophe. The practical risk is that you become an easier target for convincing, personalized messages. If you manage a team, the same applies to colleagues whose addresses appear in the leak, since attackers may impersonate you to reach them.
Steps to Take If Your Email Was Exposed
- Change your Crunchbase password if you have an account, and change it anywhere else you reused it.
- Use a password manager to create a unique password for every service, so one breach cannot unlock another.
- Turn on multi-factor authentication, preferably with an authenticator app or a hardware key rather than SMS.
- Verify unexpected requests out of band. If an email asks for payment, credentials, or sensitive files, confirm through a phone number or channel you already trust, not one supplied in the message.
- Alert your IT or security team if a work address is affected, so they can watch for impersonation attempts.
- Be cautious with links and attachments in messages that reference your job or company, even if the sender looks familiar.
The Bottom Line
The Crunchbase data breach Have I Been Pwned listing is a reminder that an extortion attempt can end in a public leak months later. Search your personal and work email addresses in Have I Been Pwned today, then work through the protective steps above. For more context on how pressure campaigns like this unfold, read our coverage of the Gentlemen ransomware claims linked earlier in this post.
