Collection #1 data breach: what the 773 million email list was
2 min read · Updated October 15, 2026
Collection #1 was a compilation of credentials from many earlier breaches, discovered in 2019. Researchers reported about 773 million unique email addresses and roughly 21 million unique passwords. It was mostly old data recycled together, which attackers use in credential stuffing. Change reused passwords and check your email.
What it was
Collection #1 was not a single hack. It was a large folder of credentials gathered from numerous older incidents and combined. Such compilations are popular because attackers can run a single list against many sites.
What was in it
- ✓Email addresses.
- ✓Passwords in plain text, drawn from earlier breaches.
Were you caught up in a major breach?
Old breaches keep circulating for years. Check your email against known breach records for free.
Why compilations are dangerous
They do not tell you which site leaked your password, so many people do not know whether they are affected. They are ideal fuel for credential stuffing: a reused password from an old incident can unlock a newer account.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
Frequently asked questions
Was it a new breach?+
It combined data from earlier incidents, so most of it was not new, but it increased exposure for anyone who reused passwords.
How can I tell which password was exposed?+
Often you cannot. Assume that any reused password may be affected and replace it.
Is there a similar list today?+
Compilations of leaked credentials continue to circulate, which is why unique passwords and 2FA matter.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.