People search Hostinger data breach timeline because the brand sits on billions of accounts, credentials, and cloud workloads. BreachHistory indexes 2 Hostinger-linked incidents, with headline counts up to 14M+ in catalog rows. This page maps every attested event through 2026 with internal links to canonical records.
Why Hostinger breach history matters
Hostinger operates in Technology. Across indexed rows, recurring themes include unverified actor or scraping claims. Understanding the chronological pattern helps security teams, customers, and regulators separate confirmed disclosures from forum marketing.
Full timeline through 2026
2026 — DozerMx forum claim; ~4.4M records, 58k+ ID photos, 61 domains (unverified)
Unverified claim — treat actor counts cautiously. Unverified criminal-forum claim — observed July 11, 2026. Threat-intelligence reporting summarized actor DozerMx advertising extraction of approximately 4,418,729 database records, more than 58,000 identification photographs, and source code from 61 domains on Hostinger shared hosting in Colombia. The listing allegedly includes tables tied to Colombian public-procurement (SECOP II) contacts with names, tax IDs, phones, and addresses, plus compressed archives of ID card images (fotosCarnetizados.tar.gz). VECERT Rada Exposed categories include Actor-claimed ~4.4M database records, 58,423 ID document photographs, mobile app source code (Ionic), and SECOP II public-procurement contact tables across 61 Colombian domains—unv. BreachHistory cites approximately 4.4M+ affected records in this row. See the hostinger-colombia-dozermx 2026 record and canonical BreachHistory entry.
2019 — 14M customer records
Cataloged incident. Hostinger discovered an unauthorized third party gained access to an internal system API server containing customer data. The breach was discovered on August 23, 2019. Passwords were protected with SHA-1 hashing (later upgraded to SHA-256). Payment information was not affected as financial data was processed through a third-party provider. Exposed categories include Usernames, emails, first names, IP addresses, hashed passwords. BreachHistory cites approximately 14M+ affected records in this row. See the hostinger2019 and canonical BreachHistory entry.
Patterns and analysis
- Unverified actor or scraping claims — appears across multiple Hostinger catalog entries; prioritize controls that address this class of failure.
- Record-count hygiene — BreachHistory indexes actor-cited figures separately from company-confirmed totals; read each row's technicalWriteup before treating counts as fact.
- 2026 monitoring — New disclosures roll into this timeline as they are verified or labeled unverified per catalog policy.
What to do if you may be affected
- Step 1: Enable phishing-resistant MFA on every account tied to this brand.
- Step 2: Use unique passwords and a password manager—breach rows often involve credential reuse.
- Step 3: Monitor official company breach notices and regulator filings, not dark-web downloads.
- Step 4: Review OAuth app permissions and revoke unused third-party integrations.
- Step 5: Bookmark the Hostinger company page for new 2026+ disclosures.
Canonical BreachHistory hub
Explore every indexed row: breachhistory.com/hostinger · Latest: hostinger-colombia-dozermx2026.
Sources: BreachHistory catalog (2 rows for Hostinger), company and regulator disclosures cited in individual breach records.