CastleRAT data breach
179,745 accounts found in malware logs.
Check whether your email is included on Have I Been Pwned.
What was exposed
Email addressesPasswords
What to do
- Change your CastleRAT password, and the password on any other site where you used the same one.
- Expect more phishing emails that mention this service. Do not click links in them; go to the site directly.
- Turn on two-step verification wherever it is offered, and use a password manager.
About this breach
In November 2026, Europol and international law enforcement partners dismantled infrastructure supporting several malware operations. Among them was CastleRAT, a remote access trojan (RAT) that enabled criminals to remotely control infected computers. Europol provided HIBP with 180k email addresses associated with CastleRAT infections, along with 893k unique passwords observed more than 3M times across accounts used on infected computers. The passwords are now searchable via Pwned Passwords.