euronote.hu

Researchers have linked a dataset of roughly 817,000 email addresses and passwords to the domain euronote.hu, and the investigation team has indexed it as a breach listing. According to the team's fields, the listing contains 817,161 rows, including 817,161 email addresses and 815,482 passwords, with an estimated breach date of January 1, 2020. No hacking group has claimed responsibility for the data.

The listing's origins point to a much larger event. In January 2024, cybersecurity researcher Bob Diachenko and the Cybernews research team discovered an unprotected database of about 26 billion records spanning some 12 terabytes, assembled from thousands of earlier leaks and breaches. The archive became known as the "Mother of All Breaches" (MOAB), and euronote.hu appeared in its published list of thousands of affected domains, alongside other Hungarian sites such as Soproni.hu and Invitel.hu.

Importantly, inclusion in such a compilation does not prove that euronote.hu itself was hacked. As Hungarian technology reporting on the MOAB noted, a domain appearing in the archive means credentials associated with that site surfaced in leaked data, not necessarily that the site's servers were breached. No verified company notice from euronote.hu, and no major news coverage focused specifically on the site, has been confirmed in the sources reviewed.

Limited public reporting: As of September 25, 2026, detailed company notices or major news coverage for this listing were limited in sources reviewed. The facts below rely primarily on the indexed fields plus any secondary sources cited.

What Information Was Compromised?

Our analysis found the following data types in this breach: email addresses (817,161 records) and passwords (815,482 records).

Because the dataset appears to be a credential compilation rather than a single confirmed server compromise, no additional personal details such as names, addresses, or financial information have been verified for this listing.

Not every individual is affected by every type of data listed here.

What Are the Potential Risks for Affected Individuals?

The main risks tied to leaked email and password pairs are:

Credential stuffing. Attackers feed leaked email and password combinations into login pages for banking, shopping, and social media accounts. If you reused the same password elsewhere, those accounts are at risk.

Account takeover. Any account still using a password from this dataset can be logged into directly by whoever holds the data.

Phishing. With a working email address in hand, scammers can send convincing messages that appear to come from services you use, trying to extract more information or payments.

The 2020 estimated date matters here. Even if you changed the password long ago, old passwords are valuable to attackers because people often reuse or slightly vary them across sites and years.

What Should You Do If You Were Affected?

Change the password for any account that used the exposed password, and change it anywhere else you reused it.

Use long, unique passwords for each account, ideally stored in a password manager.

Turn on two-factor authentication wherever it is offered, especially for email, banking, and payment accounts.

Be cautious with unexpected emails referencing your account or asking you to log in; go to the site directly rather than clicking links.