Addi Fintech Breach: 34 Million Accounts Exposed by ShinyHunters

In March 2026, the Colombian fintech Addi reported unauthorized activity on its platform, cautioning customers about potential personal information compromise. The “pay or leak” group ShinyHunters subsequently claimed responsibility, publishing a massive data trove allegedly exfiltrated from Addi.

Have I Been Pwned confirms the breach exposed 34 million unique email addresses. This data originated from credit scoring requests, credit bureau records, customer identity records, and email validation logs. Critically, the leak also included sensitive government-issued IDs (Cédula de Ciudadanía), estimated income, socioeconomic levels, purchase history, and other credit-related data points.

This incident highlights the severe risks fintech companies face. The depth of personal and financial data held by Addi makes this a goldmine for identity theft and sophisticated social engineering campaigns. Defenders must recognize that such comprehensive datasets enable attackers to craft highly convincing phishing lures and bypass less robust authentication mechanisms.