Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Breach occurred 2026-11-12VerifiedWhat happened
In November 2026, Europol and international law enforcement partners dismantled infrastructure supporting several malware operations. Among them was CastleRAT, a remote access trojan (RAT) that enabled criminals to remotely control infected computers. Europol provided HIBP with 180k email addresses associated with CastleRAT infections, along with 893k unique passwords observed more than 3M times across accounts used on infected computers. The passwords are now searchable via Pwned Passwords.
Data exposed
Frequently asked questions
The CastleRAT data breach occurred on November 12, 2026. It was added to Have I Been Pwned's breach catalog on November 13, 2026.
179,745 accounts were affected by the CastleRAT data breach, according to Have I Been Pwned's records.
The CastleRAT breach exposed the following data types: Email addresses, Passwords.
Yes. Have I Been Pwned has verified the CastleRAT breach, meaning there's confirmed evidence the exposed data is genuine and tied to real accounts.
Use KazaSec's free Email Breach Checker (/tools/breach-check) to check whether a specific email address has surfaced in the CastleRAT breach, or any other known breach, the tool never stores what you search.
Our free Email Breach Checker tells you whether a specific email address has surfaced in this breach, or any other known breach, without ever storing what you search.
Check your email →Other breaches exposing Email addresses
Talk to us about this
We help organizations find and fix the gaps that lead to a breach, before they do.
