Home Design 3D Data Breach
The December 2025 Home Design 3D data breach occurred when unauthorized threat actors gained access to the community and account management database of Home Design 3D (homedesign3d.net), the globally acclaimed 2D/3D floor planning and interior design application boasting over 50 million downloads across iOS, Android, macOS, and PC.
Exposed Data Types
3- Email addresses
- Names
- Usernames
About This Breach
The data was published on BreachForums by the threat actor known as @Spirigatito.
What information was affected in the Home Design 3D incident?
The leaked JSON account export (homedesign3d.json) contains registered user records from the cloud sync and community system. The breach compromised records belonging to 295,641 unique verified users, exposing:
- Contact Details: Verified canonical email addresses (including direct email accounts and Apple Private Relay aliases).
- Personal Identifiers: First names (prenom) and last names (nom).
- Account Telemetry: Community login handles, Apple ID sign-in references, and Facebook OAuth identifiers.
How many accounts were affected?
Rigorous RFC canonical validation and deduplication confirmed 295,641 unique valid email addresses across more than 301,000 raw member records.
Technical analysis and security risks
The exposure of verified email addresses combined with real names and third-party login identifiers elevates the risk of targeted social engineering and software update phishing schemes designed to distribute malicious payloads under the guise of architectural plugins or premium asset packs.
Recommended actions for affected users
Users who created accounts with Home Design 3D should:
- Rotate passwords on any accounts where identical or similar credentials were used.
- Maintain heightened scrutiny towards unsolicited emails alleging subscription expirations or license validation issues.
- Enable multi-factor authentication (MFA / 2FA) across all primary email and cloud accounts.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
