onevers.com

Our investigation team has indexed a dataset associated with the domain onevers.com that contains records for more than half a million email addresses. According to our catalog entry, the dataset holds 500,585 rows, nearly all of them paired with passwords: 500,524 password entries alongside 500,585 email addresses. We estimate the breach occurred around January 1, 2020. The entry was added to our database on December 1, 2024, and no individual or group has publicly claimed responsibility for it.

Limited public reporting: As of September 25, 2026, detailed company notices or major news coverage for this listing were limited in sources reviewed. The facts below rely primarily on the indexed fields plus any secondary sources cited.

What Information Was Compromised?

Our analysis found the following data types in this breach: email addresses and passwords.

Because the dataset pairs email addresses with passwords, anyone holding the file can attempt to log in to accounts registered under those addresses. Passwords in indexed collections are sometimes stored in hashed or obfuscated form rather than plain text, but we cannot confirm the storage format for this dataset based on the fields available to us.

Not every individual is affected by every type of data listed here.

What Are the Potential Risks for Affected Individuals?

The main risk from an email-and-password dataset is credential stuffing. Attackers take the email and password pairs from a leaked list and replay them against login pages for other services, from email providers to banking apps and shopping sites. The attack works because many people reuse the same password across multiple accounts.

Even if the password in this dataset is old or outdated, it can still help attackers. A previously used password often reveals patterns a person favors, such as a pet's name plus a number, which attackers can combine with guesswork against current accounts. Leaked email addresses are also fed into phishing campaigns, where recipients receive messages designed to look like security warnings or urgent account notices.

If you reused the password that appeared in this dataset on any other account, that account should be treated as exposed as well.

What Should You Do If You Were Affected?

If your email address appears in this dataset, or if you used onevers.com around January 2020, take these steps:

Change your password on any account that still uses it. Start with your email account, since email is the recovery point for most other services.

Use a unique password for every service. A password manager makes this practical.

Turn on two-factor authentication wherever it is offered, especially on email, banking, and social media accounts.

Watch for phishing. Be cautious with unexpected emails that ask you to verify accounts, reset passwords, or click links. Go to a site by typing its address directly rather than following email links.

Check your other accounts for unusual activity, such as login alerts from unfamiliar devices or password reset emails you did not request.