Addi Breach: 34M Emails & IDs Exposed by ShinyHunters (2026)
In March 2026, the Colombian fintech company Addi identified unauthorised activity on its platform and advised customers that "it is possible that your personal information may have been compromised". The "pay or leak" extortion group ShinyHunters subsequently claimed responsibility and published a ...
Overview
On March 30, 2026, the Colombian fintech company Addi detected unauthorised activity on its platform. In a notification to customers, Addi warned that “it is possible that your personal information may have been compromised.” The “pay or leak” extortion group ShinyHunters quickly claimed responsibility, publishing a massive trove of data that includes 34,532,941 unique email addresses, along with extensive credit and identity records. The breach was reported to Have I Been Pwned, making it one of the largest data leak events linked to a Latin American fintech company.
What Was Exposed
The leaked dataset is not limited to email addresses. According to the breach description, the exposed records include a wide range of sensitive information:
- Email addresses (34 million unique entries)
- Government-issued IDs (Cédula de Ciudadanía)
- Estimated income and socioeconomic levels
- Credit scoring requests and credit bureau records
- Customer identity records
- Email validation logs
- Purchase history and other credit-related data points
The presence of government IDs and financial data elevates the severity of this breach far beyond a standard credential dump.
How the Breach Happened
Addi has not publicly detailed the initial attack vector, but the breach aligns with a common pattern among ShinyHunters attacks. The group typically gains access through compromised credentials, unsecured databases, or third-party vulnerabilities. Given the breadth of data - spanning credit scoring logs, identity records, and purchase data - the attacker likely obtained database-level access rather than exploiting a single application flaw. For related vulnerability trends in the region, see our cybersecurity news coverage.
The Attacker
ShinyHunters is a well-known “pay or leak” extortion group. The group does not deploy ransomware; instead, it exfiltrates data and demands payment to prevent public release. When victims do not pay, ShinyHunters publishes the entire dataset. In Addi’s case, the data was published in full, indicating the ransom was not met.
Identity Theft Risks
The exposure of government-issued IDs (Cédula de Ciudadanía) combined with income, socioeconomic data, and purchase history creates a severe identity theft risk. With a Colombian national ID number, a determined attacker can:
- Apply for fraudulent loans or credit lines
- Open accounts in the victim’s name
- Exploit the socioeconomic data for targeted phishing or social engineering scams
Victims should monitor their credit reports with Colombian credit bureaus (such as Datacrédito and Procrédito) for any unauthorised inquiries or accounts.
How to Check If You’re Affected
Addi customers and Colombian residents who have interacted with the company should check if their email addresses appear in the breach. The dataset has been loaded into Have I Been Pwned. Visit haveibeenpwned.com and enter your email address. If your address appears, your identity data (including your Cédula de Ciudadanía) may be in the hands of attackers.
What to Do Right Now
If you are affected:
- Place a fraud alert on your credit report with Datacrédito and Procrédito.
- Review all recent financial statements and credit inquiries for unauthorised activity.
- Enable two-factor authentication on your Addi account and any service using the same email address.
- Be vigilant for phishing attempts referencing your income, credit score, or purchases - attackers have detailed personal data to make scams convincing.
- Change your password on Addi and any other accounts using the same credentials.
Security Insight
This breach reveals a troubling gap in data governance at Addi. The inclusion of credit bureau records and email validation logs suggests that Addi retained more customer data - for longer - than necessary for its core business. Fintech companies handling government IDs and credit data must implement strict data minimisation policies and rigorous access controls. Breaches of this scale at a single fintech platform undermine consumer trust in the broader digital banking ecosystem in Latin America. For more on related vulnerabilities, see the CVE-2026-31944: LibreChat advisory and the Addi ransomware attack summary at Addi.com Ransomware Attack by ShinyHunters.
Further Reading
Never miss a data breach report
Get real-time security alerts delivered to your preferred platform.
Related Breach Reports
In 2019, the now-defunct B2B marketing leads database service LimeLeads suffered a data breach due to an exposed, unsecured Elasticsearch server. The incident exposed tens of millions of records of largely corporate contact data containing 17.8M unique email addresses, along with phone numbers, empl...
In August 2026, clothing retailer Carhartt was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data allegedly obtained from the company including 12.9M unique email addresses, names, phone numbers and physical addresses. The published corpus also cont...
In July 2025, the German news service NIUS suffered a data breach which was subsequently leaked publicly . The data included 6k unique email addresses along with names, physical addresses and payment details for purchases including either IBANs or partial credit card data (masked card number, type a...
In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates . The breach resulted in the exposure of 145k unique email addresses along with usernames and passwords stored as either MD5 or PBKDF2 hashes. OTW self-submitted the exposed...