LegionProxy Breach Exposes 10,000 Accounts
The commercial proxy network LegionProxy has disclosed a data breach impacting approximately 10,144 accounts. The incident, which occurred in April 2026, resulted in the exposure of customer email addresses, bcrypt password hashes, names, and purchase details.
This breach highlights the ongoing risks associated with third-party data handlers, even those providing seemingly innocuous services like proxy networks. Attackers gaining access to such databases can harvest credentials for further targeted attacks or build profiles for malicious purposes.
What This Means For You
- If your organization utilizes LegionProxy or similar proxy services, audit your associated accounts immediately. Force password resets for any credentials linked to LegionProxy and enable multi-factor authentication wherever possible. Review purchase history for any anomalies that might indicate unauthorized activity.
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
LegionProxy Data Breach - Customer Data Exposure
Written by SCW Research
Take action on this incident