17.2 billion exposed accounts: what our global data breach catalog reveals

None of these breaches carry per-country data — and that's exactly why they still reach African mobile money accounts too: a reused password doesn't know borders.

October 20, 2026 · SunuCyberSecurity team

Source: our local catalog, synced from Have I Been Pwned — data as of October 20, 2026

Our data breach catalog tracks 950 real incidents, synced from Have I Been Pwned — the industry's free, verified global reference. Cumulated, those 950 breaches add up to 17.2 billion exposed accounts (a single email can appear in several breaches, so this isn't a count of unique people). This catalog carries no per-country data — HIBP doesn't provide that — but that doesn't mean francophone Africa is spared: it means we can't measure it directly, and this article explains why the threat stays real regardless.

The biggest breaches in our catalog

The largest entry isn't a single company's breach: "Synthient Credential Stuffing Threat Data" is a compiled list of already-stolen credentials, assembled and circulated for credential-stuffing attacks (trying known email/password combinations en masse against other services) — with data dated April 2025 (the entry itself was only added to our catalog in November 2025), with 1.96 billion email/password entries. "Collection #1" (2019) and "Verifications.io" (2019) follow, each close to 800 million accounts.

Why the same breach gets wildly different numbers depending on the source

A concrete example, right in our own catalog: the "National Public Data" breach (NPD, a US background-check company) is recorded there with 134 million accounts — HIBP's figure, based on unique, deduplicated email addresses actually present in the leaked data. A lawsuit filed against NPD claimed 2.9 billion compromised records instead, widely repeated in the press. The gap isn't an error on either side: the lawsuit figure most likely counts database rows (30 years of address history, family members, duplicates), not unique accounts or people — a very different methodology, for a far more dramatic number. We chose to keep HIBP's methodology (deduplicated, verifiable) over the more spectacular figure.

Why it also threatens a mobile money account

In our article on AI-boosted mobile money fraud, we detailed SIM swap and voice deepfakes — targeted attacks. Data breaches fuel a quieter but larger-scale vector: credential stuffing. A user who reuses the same password across their Facebook account (breached in 2019, 509 million accounts in this catalog) and their mobile money account hands an attacker a combination already worth trying, with no need to personally target anyone — the attack is automated, runs at scale, and doesn't stop at any country's border.

What we know — and what we don't

Honestly: we can't say what share of these 17.2 billion accounts belongs to users in francophone Africa — HIBP provides no geographic data, and we won't invent a figure we don't have. What we can say with confidence: (1) this catalog keeps growing — 182 new breaches since January 2025, the latest sync dated today; (2) password reuse itself has no geographic border — a password leaked on the other side of the world stays valid everywhere it's reused.

Related reading

Methodology

Data from our local data breach catalog, synced from the free, public Have I Been Pwned API (haveibeenpwned.com), global scope, no geographic filter (HIBP provides no per-country data). Figures verified in the database on October 20, 2026. The exposed-account count is cumulated across every breach on record; a single account can appear in multiple breaches.

Put this into practice

A free scan, in a few minutes, no credit card.