Doxbin 2022 Data Breach

Account records also contained usernames, password hashes, and browser user-agent details; doxes could contain extensive personal information such as names, physical addresses, and phone numbers. Those fields must not be assumed to co-occur for every match.

The Doxbin MySQL dump in LeakData’s sealed complete source archive contains 31 table schemas and 1,059 INSERT statements. The email-only import selects only the explicit address-semantic blacklist.email, users.email, and users_deleted.email columns; it does not scan pastes.content, comments, logs, messages, or other free-text fields.

From 51,367 selected value slots, the parser recovered 41,513 valid email occurrences; 9,854 blank, NULL, or invalid values and 24 ambiguously embedded email-shaped tokens inside explicit columns were excluded. After removing 18 duplicate occurrences, the local index contains 41,495 unique canonical emails. This local subset was not fitted to the public 370,794-event count and is not claimed to represent the complete event population.

A local match proves only that the address string occurred in one of the processed explicit email columns. It does not prove Doxbin membership, account or content ownership, authorship of a dox, target or victim status, unlawful conduct, or the presence of any other personal field in the same row. Because the source is sensitive, content context and associated personal information are not published.

People who know they used a Doxbin account should change any password they used in 2022 if it was reused elsewhere and enable two-factor authentication on their email account. Anyone facing a safety risk connected to non-consensual personal-information publication should preserve evidence and contact appropriate platform or local support channels.