2026 SongTrivia2 — public forum leak; 291k emails, OAuth tokens, bcrypt hashes, and profiles
Data compromised
Auth tokens, avatars, email addresses, names, bcrypt password hashes, usernames
Technical writeup
Have I Been Pwned added a SongTrivia2 breach on April 4, 2026 after data from the music trivia platform was published to a public hacking forum. HIBP described 291.7k affected accounts, with email addresses sourced from Google OAuth logins or native site accounts. Native accounts also included bcrypt password hashes. The dataset additionally contained authentication tokens, names, usernames, and avatar data.
Root cause
Publicly posted application account dump; root intrusion vector not specified in HIBP summary