CastleRAT Data Breach: 179K Emails & Passwords Exposed (2026)
Risk Assessment
CastleRAT malware stole 179K email addresses and 893K passwords from infected computers. Check if you're affected and secure your accounts now.
What to do
Change your CastleRAT password immediately. Enable two-factor authentication. Monitor your accounts for suspicious activity. If financial data was exposed, contact your bank and consider a credit freeze.
- See whether your email is in it: check on Have I Been Pwned
- Passwords were exposed: change the CastleRAT password and every account that reused it.
- Email addresses were exposed: expect phishing that mentions CastleRAT.
Overview
Europol has handed over 179,745 email addresses tied to CastleRAT infections to Have I Been Pwned (HIBP), making them publicly searchable for the first time. The disclosure follows a November 2026 operation in which Europol and international law enforcement partners dismantled the infrastructure behind several malware operations, including CastleRAT.
CastleRAT is a remote access trojan - a type of malware that gives criminals full remote control over an infected computer. That control went well beyond spying. Once inside, attackers harvested login credentials stored in browsers and elsewhere on the machine. Alongside the 180k email addresses, Europol provided HIBP with 893,000 unique passwords observed more than 3 million times across accounts used on infected computers. Those passwords are now searchable through the Pwned Passwords service.
What Was Exposed
Two data types are involved, and both carry real risk:
- Email addresses (179,745): These identify the accounts and machines linked to CastleRAT infections. On their own they enable targeted phishing and account enumeration.
- Passwords (893,000 unique): These are far more dangerous. They were stolen directly from infected computers, meaning they are real passwords that were actually in use - not guesses or recycled lists. Because people often reuse passwords, each one may unlock multiple accounts.
The gap between 180k emails and 893k passwords matters: many stolen passwords likely belong to accounts that were logged into on a shared or infected machine, not just the primary email owner.
Account Takeover Risks
Stolen credentials are the raw material for credential stuffing - automated attempts to log into other services using the same email and password combination. If you used any of the harvested passwords on more than one site, a single leaked password can cascade into email, banking, social media, and shopping account compromises. Because the passwords were captured from live machines, attackers may also know which services you use, making their phishing attempts far more convincing.
What to Do Right Now
- Check HIBP - visit the CastleRAT breach page or search your email at haveibeenpwned.com. Search your passwords at the Pwned Passwords service to see if any of yours appeared.
- Change every reused password immediately - start with email, banking, and any account with payment details.
- Use a password manager to generate unique passwords for every account.
- Enable two-factor authentication (app-based, not SMS, where possible) on all critical accounts.
- Scan your device - if your email appears in this breach, your computer may have been infected. Run a reputable anti-malware scan and consider a full reset if CastleRAT is detected.
- Watch for phishing referencing your real accounts and services - attackers now have context.
Security Insight
This breach is unusual because it is a byproduct of a law enforcement takedown rather than a company disclosure - and the affected individuals were victims of malware, not of a single careless vendor. The 893k passwords dwarfing the 179k email addresses is the tell: credential theft from endpoints is indiscriminate and collects everything a victim ever typed, not just one service’s data. It also reinforces a hard lesson for the wider cybersecurity news landscape - RAT operators treat infected machines as credential farms, so endpoint hygiene is now an account-security control, not just an IT concern.