InterPals 2015 Data Breach
The InterPals 2015 data breach concerns account data attributed to the online pen-pal and language-exchange service.
Exposed Data Types
6- Dates of birth
- Email addresses
- Geographic locations
- Names
- Passwords
- Usernames
About This Breach
A verified breach index dates the event to 4 November 2015 and reports 3,439,414 unique email identifiers in the external dataset. The index description says the site was hacked and approximately 3.4 million accounts were exposed; the 3,439,414 value is not treated as a unique-person count or a count of accounts active today.
Supported data types for the external dataset are dates of birth, email addresses, geographic locations, names, usernames, and salted password hashes. The public analysis does not disclose the hash algorithm or parameters. Private messages, IP addresses, phone numbers, physical addresses, payment data, and identity documents are not among the verified data classes.
External and local count boundary
Separate from the 3,439,414 external unique email identifiers, a production email-only job processed 3,439,197 lines and produced 3,439,178 unique emails in the live index. These three values are different measures and are not added together. The local job contains no date-of-birth, location, name, username, or password-hash field, so those classes rely solely on the external dataset analysis.
Evidence and privacy boundary
Manual review found no current first-party incident notice or reliable independent technical report detailing the access method. The organization's current About page confirms that the service has operated since 1998 for pen pals, cultural exchange, and language learning, but it does not describe the 2015 event. An email match does not prove a current account, legal identity, age, precise location, correspondence, friendships, or language preferences.
Safe next steps
If a person independently knows the old password used for this account in 2015 and still uses the same or a similar password on another active account, only the reused password should be replaced with a unique one, and multifactor authentication should be enabled, especially on the associated email account. Unexpected messages using an old platform context, name, or location should be verified through a known official channel. A salted hash is not a plaintext password, and a match must not be treated as evidence of account takeover.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
