Kayo.moe Credential Stuffing List Data Breach

What happened

In September 2018, a collection of almost 42 million email address and plain text password pairs was uploaded to the anonymous file sharing service kayo.moe. The operator of the service contacted HIBP to report the data which, upon further investigation, turned out to be a large credential stuffing list. For more information, read about The 42M Record kayo.moe Credential Stuffing Data.

Exposed data

Recommended actions

• Change your Kayo.moe Credential Stuffing List password immediately, and update it anywhere you reused the same password.
• Enable two-factor authentication on the affected account and on your critical services (email, banking).
• Watch for targeted phishing emails referencing Kayo.moe Credential Stuffing List — attackers weaponise breach data quickly.
• Check whether your email address appears in this breach on haveibeenpwned.com.