Breach registry
CastleRAT Data Breach
What was exposed, when it happened, and which databases confirm it.
- accounts
- 179,745
- Breached
- November 12, 2026
- Last Update
- November 13, 2026
Were you caught in this breach?
Search your email, phone number or username against every record CheckLeaked indexes.
Your address never leaves this page: it is hashed in your browser and only a short fragment of that hash is sent.
What happened
In November 2026, Europol and international law enforcement partners dismantled infrastructure supporting several malware operations. Among them was CastleRAT, a remote access trojan (RAT) that enabled criminals to remotely control infected computers. Europol provided HIBP with 180k email addresses associated with CastleRAT infections, along with 893k unique passwords observed more than 3M times across accounts used on infected computers. The passwords are now searchable via Pwned Passwords.
Compromised Info
- Email addresses
- Passwords
Attestation
Four independent databases catalog this breach and they do not always agree. Each lane below is one source’s own count.
Sources & Link Methods
- HIBP
FAQ
What was leaked in the CastleRAT breach?
The CastleRAT breach exposed: Email addresses and Passwords.
When did the CastleRAT breach happen?
The CastleRAT breach was disclosed on November 12, 2026 and affected 179,745 records.
Am I affected by the CastleRAT breach?
Search your email, phone or username at checkleaked.cc to find out whether your data appears in the CastleRAT leak.