2026 Notion — unverified darkweb listing; 110M+ user records alleged for sale (June 23)
Data compromised
Actor-claimed records include email addresses, password hashes, IP addresses, and comprehensive account data—unverified; Notion has not confirmed any breach
Technical writeup
Unverified darkweb listing — June 23, 2026. A threat actor advertised a dataset allegedly linked to Notion on a darkweb marketplace, claiming 110 million+ unique user records comprising email addresses, password hashes, IP addresses, and account metadata. The listing was reported by DailyDarkWeb and MonThreat on June 23, 2026. Notion had not acknowledged any breach, infrastructure incident, or unauthorized data access at catalog time. The actor-cited 110M figure is used as the unverified recordsAffected per BreachHistory policy; actual impact is unknown. This entry is separate from the 2026 Notion EU consumer litigation row (AI training allegations). Update if Notion confirms.
Root cause
Unverified threat-actor listing on darkweb marketplace claiming a database of 110M+ Notion user records; Notion had not confirmed at catalog time