HuntStand data breach: what happened and what to do

In March 2024, about 2.8 million HuntStand user records were posted to a hacking forum. HIBP lists 2,795,947 accounts. The data included email addresses, names, dates of birth and locations. No passwords were reported.

View all 13,177 breaches

Breach date: 8 Mar 2024
Affected: 2,795,947
Data exposed: Dates of birth, Email addresses, Geographic locations, Names
Verified: Yes
Last updated: 24 Oct 2026

Source: Have I Been Pwned (CC BY 4.0)

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

HuntStand is a hunting and land management app. In March 2024, millions of records scraped from the service were posted publicly on a hacking forum. Have I Been Pwned (HIBP) added the breach on 19 September 2024 and lists 2,795,947 affected accounts, with 2.8 million unique email addresses.

Security news site CyberInsider reported that the poster claimed to have scraped more than 2.9 million user records, and that the exposed fields included names, email addresses, birthdates and countries. No passwords were reported.

Sources checked: haveibeenpwned.com, cyberinsider.com, consumer.ftc.gov

Last verified against the official page: 24 Oct 2026

How we research this Report an error

What was exposed

HIBP lists dates of birth, email addresses, geographic locations and names. Many records had only an email address, while others also carried a name, date of birth and country.

What that lets criminals do

An email address with a real name and birth date is enough to write a convincing phishing email. A date of birth is also one of the details used to verify identity, so it's worth keeping to yourself where you can. Because the records tie your email to an interest in hunting and land ownership, expect scam messages that play on that.

The company's response

If you have a HuntStand account, watch the inbox of the email address you signed up with, and go to the company's own site rather than clicking links in any message about the breach.

What to do

Because no passwords were reported, a password change isn't urgent for this breach alone, but it's still sensible if you reuse passwords. The bigger risk is phishing that quotes your name or birth date.

What to do if you were in it

1

Expect phishing that mentions the breach

Treat unexpected emails, texts and calls with suspicion, especially ones that mention this breach or ask you to act fast. Don't click links in them; go to the company's site yourself. The FTC explains how to spot phishing.
2

Be careful with your date of birth

A date of birth can be used to verify your identity with banks and other services. Don't share it unless a service needs it. If you think your identity has been misused, report it at IdentityTheft.gov.
3

Change your password, and any you reused

Change your HuntStand password, and the password on every other account where you used the same or a similar one. Use a unique password for each account (see CISA's guidance).
4

Turn on two-factor login

Add two-factor authentication to your important accounts, starting with email. CISA recommends turning it on wherever it's offered.
5

Check whether your email or phone is in this and other breaches

Run a free Serus scan to see which breaches include your email or phone number. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak. It can't remove data that has already leaked.