Addi Data Breach (2026)

On March 25, 2026, Colombian fintech company Addi disclosed unauthorised activity on its platform and warned customers that 34.5 million individuals may have had their personal information compromised. The “pay or leak” extortion group ShinyHunters later claimed responsibility and published what it said was a large sample of the stolen data.

What's Publicly Reported from Reporting

Public reporting indicates the breach involved data drawn from credit scoring requests, credit bureau records, customer identity records and email validation logs. The exposed information includes names, email addresses, phone numbers, physical addresses, government-issued IDs (Cédula de Ciudadanía), IP addresses, latitude and longitude pairs, device information, age groups, income levels, credit scores, socioeconomic levels and purchase history.

Available reporting describes the incident as affecting approximately 34.5 million unique email addresses. Addi notified customers directly after detecting the unauthorised access but has not released a detailed technical timeline.

Why This Matters for You and Your Family

When a single company holds your name, address, government ID, credit score, income bracket and phone number together, the risk extends beyond one account. Criminals can combine those details to open new loans, request credit cards in your name, or impersonate you with banks and government agencies. For families, the exposure of children’s or spouse’s information alongside yours creates a household-wide vulnerability that can affect everyone living at the same address.

Many of the records also contain precise location data and device fingerprints. That combination makes it easier for scammers to craft convincing phishing messages or to target family members with tailored extortion attempts. The breach therefore touches not only the person who applied for credit but every member of the household whose details were linked in Addi’s systems.

The Doxxing and Identity-Chain Implications

Once names, emails, phones and government IDs are public, attackers can quickly map additional online handles, social-media accounts and even children’s gaming profiles that reuse the same passwords or recovery email addresses. A single leaked credential can cascade into account takeovers across unrelated services, turning one breach into a chain of doxxing that reveals family relationships, locations and daily routines.

Credential leaks like this one cascade into account takeovers and doxxing chains. Gaming accounts belonging to you or your children are particularly exposed because young users often rely on the same email addresses or phone numbers listed in the Addi records. Public reporting indicates that such chained identities are frequently sold on underground forums and used for further extortion or identity theft.

ShinyHunters’ Publicly Known Track Record

Public reporting attributes the attack to the group known as ShinyHunters. The group emerged several years ago and has repeatedly targeted technology, education and fintech companies with a “pay or leak” playbook: gain initial access, exfiltrate large customer databases, then demand ransom while simultaneously publishing samples to pressure victims. Notable prior incidents attributed to ShinyHunters include breaches at other consumer-facing platforms where personal and financial records were later dumped after negotiations failed.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate the password you used at Addi anywhere it is reused and enable two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household — DoxxScan family coverage extends to dependents and children’s gaming accounts that chain back to the same address or recovery details.
• Let remediation specialists handle takedown requests across data brokers and suspicious sites on your behalf while you focus on securing accounts.

The incident shows that even companies you trust with sensitive financial applications can become targets, and the fallout can reach every member of your household. Start by securing the exposed credentials and mapping your full identity chain so you are not caught off guard by the next wave of phishing or impersonation attempts. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full family and household coverage that explicitly includes children’s gaming accounts.