Kayo.moe 2018 Dataset

The service operator sent the upload to the external catalogue operator for review after noticing that it appeared to contain personal data. According to the published technical account, the collection contained 755 files totalling 1.8GB. Most files resembled the username-password format used in automated account attempts, were combined from different breaches or other sources, and had obfuscated names that did not identify provenance.

The analyst extracted almost 42 million unique email addresses. After the complete load, approximately 93% of the addresses had previously appeared in the catalogue, while more than 91% of sampled passwords had already appeared in the password dataset. These percentages are not counts of new people, new breaches, or valid credentials. Because each source chain could not be identified, the record retains an unverified flag in the external catalogue; that flag does not mean the collection was never examined.

The structured external classes are email addresses and passwords, and the external narrative describes passwords in the context of plaintext pairs. The 41,826,763 value is a unique-email measure, not a verified account count or a count of complete email-password pairs. It should not be assumed that every email had a password, that a password remains valid, or that both values belonged to the same person.

The source analysis also mentions logs, partial card data, and files carrying specific service names; these are not added to the two structured classes and do not prove that the named services were breached. Phone numbers, physical addresses, government IDs, complete payment cards, and private-message content are not verified classes for this record.

Production has no import job associated with this record, and every local email, password, and other person-data collection contains zero links. No conclusion can therefore be drawn about local presence, password matches, source sites, or field co-occurrence in the external collection.

kayo.moe does not resolve in the current DNS check. A September 14, 2018 archive verifies Kayo.moe as a free, public file-hosting service; it does not authenticate the data's original sources or any individual breach. People who independently know that they reused one password across services can replace any copy that remains active with a unique password and enable multifactor authentication. An email match alone is not evidence of an active account, successful account takeover, or membership in a particular service.