Addi data breach (2026) — what was exposed and what to do

We publish these pages from public notices and reporting so you can understand what was exposed. Everything here is already public. Always confirm with the organization named in your notice.

What happened

According to public breach records, the Addi data breach on March 25, 2026 is reported to have exposed the personal information of 34,532,941 accounts.

In March 2026, the Colombian fintech company Addi identified unauthorised activity on its platform and advised customers that "it is possible that your personal information may have been compromised". The "pay or leak" extortion group ShinyHunters subsequently claimed responsibility and published a large trove of personal data allegedly obtained from Addi. The data included 34M unique email addresses from credit scoring requests, credit bureau records, customer identity records and email validation logs. It also contained government issued IDs (Cédula de Ciudadanía), estimated income, socioeconomic levels, purchases and other credit-related data points.

Addi, a Colombian buy-now-pay-later fintech operated by Adelante Soluciones Financieras, detected unauthorized activity on its platform in March 2026 and notified customers that their personal information may have been compromised. The extortion group ShinyHunters claimed responsibility and, after extortion negotiations failed, published a large trove of data drawn from Addi's customer and credit-scoring systems; the leak was added to public breach trackers on May 18, 2026, covering 34,532,941 accounts. What made it notable is the depth of the exposure — it combined identity records (names, Colombian government IDs, addresses, phone numbers) with sensitive financial and credit data including credit scores, income and socioeconomic levels, and even device, IP, and precise latitude/longitude location data.

What data was exposed

The following types of personal data were compromised:

• Age groups
• Credit scores
• Device information
• Email addresses
• Government issued IDs
• Income levels
• IP addresses
• Latitude and longitude pairs
• Names
• Phone numbers
• Physical addresses
• Purchases
• Socioeconomic levels

Breach details

This summary is compiled from public breach-notification data and known leak databases. Figures reflect what those sources report and may be revised as more is learned. If something here looks wrong or you think your information is involved, contact our support team.

We report breaches as a factual record to help people check their exposure. Inclusion here is not an allegation of wrongdoing or negligence by Addi; it reflects a publicly reported security incident.

What to do now

Based on the data exposed in this breach, here are the steps you should take:

• Because government-issued IDs and credit data were exposed, place a fraud alert or credit freeze with the credit bureaus and watch for new accounts or loans opened in your name.
• Treat any call, SMS, or email referencing your finances, income, or recent purchases as a likely targeted phishing or social-engineering attempt, and verify directly with Addi via official channels rather than links in a message.
• Watch for identity-theft attempts using your government ID (Cedula) number and report any misuse to Addi and relevant authorities.
• Since email, phone, and physical address were exposed together, expect more spam and smishing across all three channels and avoid acting on unsolicited account-verification requests.