Cit0day Data Breach

What happened

In November 2020, a collection of more than 23,000 allegedly breached websites known as Cit0day were made available for download on several hacking forums. The data consisted of 226M unique email address alongside password pairs, often represented as both password hashes and the cracked, plain text versions. Independent verification of the data established it contains many legitimate, previously undisclosed breaches. The data was provided to HIBP by dehashed.com.

Exposed data

Recommended actions

• Change your Cit0day password immediately, and update it anywhere you reused the same password.
• Enable two-factor authentication on the affected account and on your critical services (email, banking).
• Watch for targeted phishing emails referencing Cit0day — attackers weaponise breach data quickly.
• Check whether your email address appears in this breach on haveibeenpwned.com.