Estonian Citizens (via Estonian Cybercrime Bureau) Data Breach (2018): What Was Exposed & What To Do

In June 2018, the Cybercrime Bureau of the Estonian Central Criminal Police obtained a data set of 655,000 email addresses and passwords. The bureau contacted Have I Been Pwned to request that the records be made searchable, citing concerns that the credentials were already in use for unauthorized access to online accounts. The incident involves Estonian citizens whose email addresses and passwords appeared in material handled by the national police cybercrime unit. Public detail on the origin of the data set remains limited.

Inside the incident

The Cybercrime Bureau of the Estonian Central Criminal Police reported the data set on 7 June 2018. It contained records for 655,000 individuals. The bureau stated that the email addresses and passwords were suspected of being used to access mailboxes, cryptocurrency exchanges, cloud service accounts and similar online services. Individuals who later discovered cryptocurrency losses were asked to contact the bureau directly.

How a breach like this happens

Incidents involving large volumes of email addresses and passwords commonly begin with the compromise of an online service or the theft of stored credential files. Once obtained, the data may be tested against other services through automated login attempts. Police units sometimes receive such data sets during investigations or from third-party sources and seek to determine whether the records match known victims.

Who is Estonian Citizens (via Estonian Cybercrime Bureau)?

The Cybercrime Bureau operates within the Estonian Central Criminal Police and investigates digital offences affecting residents. It routinely handles reports involving unauthorized account access and financial losses. A data set of this size that reaches the bureau indicates the potential scale of credential misuse among Estonian internet users.

The information in question

The records made available to Have I Been Pwned consisted of email addresses and passwords. No further categories of personal data were identified in the notification from the bureau.

• Email addresses
• Passwords

What's at stake

Compromised email addresses paired with passwords can allow repeated attempts to access other accounts that reuse the same credentials. When cryptocurrency or financial services are involved, the practical consequence may include loss of funds or further account takeovers. The bureau's request for reports of stolen cryptocurrency shows that some individuals had already experienced such losses.

If your data was in this breach

Change passwords on any accounts that still use the exposed credentials and enable multi-factor authentication where available. Monitor financial and email accounts for unusual activity and report confirmed cryptocurrency theft to the address provided by the bureau. Readers can run a free exposure scan of their email address to check whether their information appears in known breach data.

AICompiled with AI assistance from public sources and published under our editorial standards.