ADDA adda.io ADDA data breach: what happened and what to do
In March 2025, data allegedly taken from ADDA, an app for managing housing societies in India, was posted online. Have I Been Pwned added 1.8 million accounts in November 2025: emails, names, phone numbers and MD5 password hashes.
View all 13,177 breaches- Breach date
- 24 Mar 2025
- Affected
- 1,829,314
- Data exposed
- Email addresses, Names, Passwords, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
ADDA, at adda.io, is software that residential housing societies in India use to run daily community life, from visitor entry to maintenance bills. According to Have I Been Pwned (HIBP), data allegedly breached from the service was posted to a public hacking forum in March 2025. HIBP dates the incident to 24 March 2025 and added it to its database on 23 November 2025.
HIBP counted 1,829,314 accounts. The Indian business outlet Entrackr reported a slightly higher figure, about 1.86 million records, based on the poster's claim. That claim was unverified, and the company hadn't confirmed it. HIBP's number is the one counted from the data itself.
Sources checked: haveibeenpwned.com, entrackr.com
Last verified against the official page:
What was exposed
Each record in the data HIBP reviewed contained:
- An email address
- A name
- A phone number
- A password stored as an MD5 hash
MD5 is an old way of scrambling passwords. It's fast. Attackers can test billions of guesses per second against a list of MD5 hashes. Short or common passwords tend to fall fast. Long, random ones usually don't. If you picked a simple password for ADDA, assume it's no longer secret.
What this lets criminals do
A name, a phone number and an email together make a ready-made phishing kit. A scammer who has your name and number can text you as your housing society or a courier. ADDA is tied to where you live. A message about society dues or a parcel at the gate will look believable.
If you reuse your password, a cracked one is the bigger risk. Attackers try the recovered email and password pair on email providers and banks. If it works on any of them, they can reset other accounts through your inbox.
The entry doesn't list home addresses, payment details or government IDs. That's HIBP's reading. Check the notice if ADDA publishes one.
The company's response
Coverage at the time reported no public statement from ADDA confirming the incident. HIBP calls the data allegedly breached, which is its label when the company hasn't confirmed what happened. If ADDA or your housing society sends an official notice, follow it. Be wary of any message that claims to be from them and pushes you to click a link.
What stays the same for you
The leaked data can't be pulled back from the forum. What you can do is make it worthless: a new unique password, two-factor login where possible, and suspicion toward messages that use your name.
What to do if you were in it
- 1
Change your ADDA password, and any you reused
Change it on ADDA first, then on every other account that used the same or a similar password. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey where the site offers one. It stops most account takeovers even when a password has already leaked.
- 3
Expect texts and calls about your housing society
Scammers who have your name and number can pose as society staff, vendors or couriers. Don't pay dues or share OTPs over a call or text you didn't start. Contact your society office through a number you already trust.
- 4
Treat messages that mention the breach as suspect
Expect emails and texts that quote your name or details to look convincing. Don't click links in them; open the company's site yourself. Our guide to stopping spam emails helps with the flood.
- 5
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the ADDA data breach?
Look up your email address on Have I Been Pwned. If ADDA is listed, your email, name, phone number and password hash were in the data.
What was exposed?
Email addresses, names, phone numbers and MD5 password hashes, according to Have I Been Pwned.
Were passwords exposed in plain text?
No. They were MD5 hashes, which are easy to crack when the password is short or common.
Should I change my password?
Yes. Change your ADDA password and any account where you used the same one, and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
What changed
- Page text rewritten in plainer language; no facts changed.
