Hopamedia data breach: what happened and what to do

Data tied to an unknown service called Hopamedia, dating to 2020, turned up in a publicly exposed database in 2024. Have I Been Pwned counts 23,835,870 accounts: email addresses, names, phone numbers, countries and mobile carriers. No passwords.

View all 13,177 breaches

Breach date: 30 Aug 2020
Affected: 23,835,870
Data exposed: Email addresses, Geographic locations, Names, Phone numbers, Telecommunications carrier
Verified: Yes
Last updated: 27 Oct 2026

Source: Have I Been Pwned (CC BY 4.0)

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Hopamedia is a strange entry in the breach record, because nobody has confirmed what the service was. In 2024, data carrying that name turned up in a publicly exposed database. Have I Been Pwned (HIBP) dates the data to 30 August 2020, added it on 16 December 2024 and counts 23,835,870 accounts.

What happened

HIBP describes the data as relating to "an unknown service referred to as Hopamedia". It sat in a database anyone could reach, with almost 24 million records. There's no company statement and no public notice from Hopamedia. Some online discussion guesses at a defunct marketing or advertising business, but nothing in HIBP's entry backs that up, so treat it as a guess.

That gap affects you directly. You may not remember ever having an account called Hopamedia. Records like these often come from sign-up forms, app promotions or lead-generation sites that collected your details under a different brand.

Sources checked: haveibeenpwned.com, cyberinsider.com

Last verified against the official page: 27 Oct 2026

How we research this Report an error

What was exposed

Per HIBP, each record held an email address, a name, a phone number, the person's country and their telecommunications carrier. HIBP files these as email addresses, geographic locations, names, phone numbers and telecommunications carrier.

The entry lists no passwords and no payment details.

What that lets criminals do

The phone number plus carrier is the part to think about. If a scammer knows which carrier holds your number, they know where to aim a SIM swap: persuading the carrier to move your number to a SIM they control. Many services still text login codes, so a swapped number can let an attacker reset passwords. It takes a determined attacker, but the carrier detail saves them a step.

Plain phishing and smishing are more likely. A text that uses your real name and mentions your mobile provider ("your plan is about to be suspended") looks real. So does an email addressed to you by name, with a link to "verify your account" at your carrier.

Then there are spam and scam calls. Phone numbers from leaked lists get sold and reused for years, so a 2020 dataset can keep your number on call lists long after.

The company's response

There isn't one on record. HIBP says the data surfaced in 2024 from an exposed database and that the service behind it is unknown. If a company notice ever appears, read it. But don't wait for one before taking the steps below.

How to check

Search your email address and your phone number on HIBP. A match means your data was in circulation. It doesn't mean anyone got into your accounts, since no passwords were included.

What to do if you were in it

1

Expect phishing that uses your details

Emails, texts and calls that mention your name, employer or phone number are more believable. Don't click links in unexpected messages. Go to the company's site yourself, and treat urgent requests for money or codes as a red flag.
2

Lock down your phone number

Call your mobile carrier and ask to add a port-out PIN or number lock. That makes a SIM swap harder, which matters because many services still send login codes by text.
3

Use an authenticator app instead of text codes where you can

Switch banking, email and social accounts from SMS codes to an authenticator app or a passkey. That takes the phone number out of the login path.
4

Don't reply to unknown calls or texts

Don't answer 'STOP' or press a number on a suspicious message. A reply confirms your number is live. Block and report it with your carrier's spam reporting number, 7726 in the US and UK.
5

Check whether your email or phone is in this and other breaches

Run a free scan with Serus. It checks breach databases for your email address and phone number and shows which breaches include you, so you know which passwords and accounts to deal with first.

Timeline

30 Aug 2020
The breach happened
16 Dec 2024
Added to Have I Been Pwned

Frequently asked

Was I affected by the Hopamedia breach?

Search your email address and phone number on Have I Been Pwned. If your details are listed under Hopamedia, they were in the exposed data.

What was exposed?

Email address, name, phone number, country and mobile carrier, per HIBP. No passwords are listed.

Who is Hopamedia?

That's unknown. HIBP describes it as an unknown service, and no company has published a notice.

Should I change my password?

Passwords weren't in the data, so there's nothing to reset because of this breach alone. Do turn on two-factor authentication and watch for phishing and SIM swap attempts.