Addi Data Breach

What happened?

In March 2026, the Colombian fintech company Addi identified unauthorised activity on its platform and advised customers that "it is possible that your personal information may have been compromised". The "pay or leak" extortion group ShinyHunters subsequently claimed responsibility and published a large trove of personal data allegedly obtained from Addi. The data included 34M unique email addresses from credit scoring requests, credit bureau records, customer identity records and email validation logs. It also contained government issued IDs (Cédula de Ciudadanía), estimated income, socioeconomic levels, purchases and other credit-related data points.

When did it happen?

The breach date in the public record is March 25, 2026. The record was added to the catalogue on May 18, 2026 and last updated there on May 18, 2026.

What information was reported as exposed?

• Age groups
• Credit scores
• Device information
• Email addresses
• Government issued IDs
• Income levels
• IP addresses
• Latitude and longitude pairs
• Names
• Phone numbers
• Physical addresses
• Purchases
• Socioeconomic levels

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with Addi or used addi.com around March 25, 2026. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.