What was exposed, when it happened, and which databases confirm it.
- accounts
- 34,532,941
- Breached
- March 25, 2026
- Last Update
- May 18, 2026
Were you caught in this breach?
Search your email, phone number or username against every record CheckLeaked indexes.
Your address never leaves this page: it is hashed in your browser and only a short fragment of that hash is sent.
What happened
In March 2026, the Colombian fintech company Addi identified unauthorised activity on its platform and advised customers that "it is possible that your personal information may have been compromised". The "pay or leak" extortion group ShinyHunters subsequently claimed responsibility and published a large trove of personal data allegedly obtained from Addi. The data included 34M unique email addresses from credit scoring requests, credit bureau records, customer identity records and email validation logs. It also contained government issued IDs (Cédula de Ciudadanía), estimated income, socioeconomic levels, purchases and other credit-related data points.
Compromised Info
- Age groups
- Credit scores
- Device information
- Email addresses
- Government issued IDs
- Income levels
- IP addresses
- Latitude and longitude pairs
- Names
- Phone numbers
- Physical addresses
- Purchases
- Socioeconomic levels
Attestation
Four independent databases catalog this breach and they do not always agree. Each lane below is one source’s own count.
Sources & Link Methods
- HIBP
FAQ
What was leaked in the ADDI breach?
The ADDI breach exposed: Age groups, Credit scores, Device information, Email addresses, Government issued IDs, Income levels, IP addresses, Latitude and longitude pairs, Names, Phone numbers, Physical addresses, Purchases, and Socioeconomic levels.
When did the ADDI breach happen?
The ADDI breach was disclosed on March 25, 2026 and affected 34,532,941 records.
Am I affected by the ADDI breach?
Search your email, phone or username at checkleaked.cc to find out whether your data appears in the ADDI leak.