Addi Data Breach (2026): What Was Exposed & What To Do

On March 25, 2026, the Colombian fintech company Addi disclosed that it had detected unauthorised activity on its platform and notified customers that personal information may have been compromised. The incident is reported to involve 34.5 million individuals. An extortion group later claimed responsibility and published a dataset said to contain records drawn from credit scoring requests, credit bureau records, customer identity records and email validation logs.

Inside the incident

Addi stated that the unauthorised activity was identified in March 2026. The company advised affected customers that it was possible their personal information had been accessed. No further technical details about the method of access, the duration of the activity or the volume of data confirmed as taken have been released by the organisation. The reported figure of 34.5 million people affected is drawn from the scale of the dataset later referenced publicly.

The extortion group ShinyHunters subsequently claimed responsibility for the incident and stated that it had published a large trove of personal data allegedly obtained from Addi. The claim includes the presence of 34 million unique email addresses along with other fields. Addi has not confirmed the completeness or accuracy of the published material.

How a breach like this happens

Incidents involving large volumes of customer and credit-related records often begin with the compromise of an application, database or third-party integration that stores or processes that information. Attackers may exploit vulnerabilities in web applications, obtain valid credentials through phishing or prior leaks, or abuse overly permissive access controls. Once inside, they can query or export tables containing identifiers, contact details and derived attributes such as income estimates or location data.

After extraction, the data is sometimes offered for sale or used in extortion attempts. Organisations in the financial technology sector frequently hold aggregated records from credit inquiries and identity verification processes, which can make any successful intrusion operationally significant even when the precise entry point remains undisclosed.

About Addi

Addi operates as a Colombian fintech company providing credit and related financial services. Companies of this type routinely collect and process personal and financial information to assess creditworthiness, verify customer identity and manage accounts. This includes government-issued identification numbers, contact details and data points used in credit decisions.

A breach at such an organisation is consequential because the records typically combine direct identifiers with attributes that can be used for account takeover, fraud or targeted scams. Colombian regulations require notification when personal data is compromised, which explains the public advisory issued by Addi.

What data was at risk

The data types named in connection with the incident are age groups, credit scores, device information, email addresses, government-issued IDs, income levels, IP addresses and latitude and longitude pairs. The published claims also reference records from credit scoring requests, credit bureau records, customer identity records and email validation logs, including Cédula de Ciudadanía numbers and estimated income figures.

The exact scope of any confirmed exposure has not been detailed by Addi. Organisations in this sector commonly hold additional fields such as names, addresses and transaction histories, but it is not confirmed whether those elements were included in the material referenced publicly.

Why it matters

Records that combine email addresses with government IDs, credit scores and location data can be used to build profiles for identity fraud or account takeover attempts. Individuals whose information appears in the dataset may face increased risk of phishing or fraudulent credit applications in the months following publication.

For the organisation, the incident adds to the operational and regulatory burden of investigating the access, notifying regulators and supporting affected customers. The long-term effect on customer trust depends on the transparency of Addi’s subsequent disclosures and the effectiveness of any remedial measures.

What to do if you're exposed

Individuals who believe their information may be involved should monitor their email and financial accounts for unusual activity and consider changing passwords on any services that reuse the exposed email address. Enabling multi-factor authentication where available reduces the chance that stolen credentials can be used to gain access elsewhere.

Readers can run a free exposure scan of their email address against known breach data to check whether their information has appeared in previously published datasets. Official guidance from Colombian data-protection authorities should be followed for any required notifications or credit-monitoring steps.

AICompiled with AI assistance from public sources and published under our editorial standards.