Operation Endgame 3.0 Data Breach (2025): What Was Exposed & What To Do

What happened

Between 10 and 13 November 2025, authorities coordinated the latest phase of Operation Endgame from Europol headquarters in The Hague. The actions targeted the Rhadamanthys infostealer, the VenomRAT remote access trojan, and the Elysium botnet. Following these measures, 2 million email addresses and 7.4 million passwords were supplied to Have I Been Pwned.

No further technical details on the method of data acquisition or the exact volume of files involved have been disclosed. The reported figures stand as the only confirmed scale of the exposure.

How a breach like this happens

Credentials of this type commonly surface when malware installed on user devices extracts stored login data from browsers, password managers, or local files. Once collected, the information can be aggregated by operators and later seized or recovered during law enforcement activity.

Public disclosure through services such as Have I Been Pwned occurs when the recovered data sets are shared for the purpose of notifying affected individuals. Timing between collection, seizure, and publication can vary and is not always documented in detail.

About Operation Endgame 3.0

Operation Endgame 3.0 is a law enforcement initiative focused on disrupting components of cybercrime infrastructure. Such operations typically involve coordination among multiple agencies and target tools that facilitate large-scale theft of credentials and remote access to compromised systems.

Organisations conducting these actions routinely handle data recovered from criminal infrastructure. Exposure of that data, even when shared for protective purposes, places the operation in the same notification channels used for conventional breaches.

What was likely exposed

The only data types confirmed in the disclosure are email addresses and passwords. No additional categories such as names, addresses, financial details, or government identifiers have been reported.

Organisations of this nature may hold further records obtained during investigations, yet the exact contents beyond the stated email addresses and passwords remain unconfirmed in public reporting.

Why it matters

Email and password combinations enable account takeover when reused across services. Individuals whose credentials appear in the data set face elevated risk of unauthorised access until passwords are changed and multi-factor authentication is applied.

For the operation itself, the publication of recovered data underscores the dual role of seized material: it supports disruption of criminal activity while simultaneously requiring standard victim-notification procedures.

Were you affected?

Check whether your email address appears in the Have I Been Pwned database using its free search tool. If matches are found, change the affected passwords immediately and enable multi-factor authentication on those accounts.

Monitor official updates from Europol or national cybercrime units for any additional guidance specific to this data set.

AICompiled with AI assistance from public sources and published under our editorial standards.