In November 2026, Europol and international law enforcement partners dismantled infrastructure supporting the CastleRAT remote access trojan, loading 179,745 breached accounts into Have I Been Pwned.
What Happened
In November 2026, Europol and international law enforcement partners dismantled infrastructure supporting several malware operations, including the CastleRAT remote access trojan. CastleRAT enabled criminals to remotely control infected computers.
Europol provided Have I Been Pwned with 180k email addresses associated with CastleRAT infections, alongside 893k unique passwords observed more than 3M times. These passwords are now searchable via Pwned Passwords.
Compromised Data
The affected addresses total 179.7k, featuring compromised email addresses and passwords. The breach was added to Have I Been Pwned on November 13, 2026.
What to do
- Change your password immediately on every account where the affected password was used.
- Enable two-factor authentication (2FA) wherever it is supported to add an extra layer of security.
Key facts and where they come from
- Europol and international law enforcement dismantled CastleRAT infrastructure in November 2026.
In November 2026, Europol and international law enforcement partners dismantled infrastructure supporting several malware operations. Among them was CastleRAT
- Europol provided HIBP with 180k email addresses and 893k unique passwords.
Europol provided HIBP with 180k email addresses associated with CastleRAT infections, along with 893k unique passwords observed more than 3M times
- There are 179,745 breached accounts listed in the CastleRAT breach.
CastleRAT – 179,745 breached accounts
The catch
- The announcement does not state how long the CastleRAT malware infrastructure operated before being dismantled.
- The breach details rely on data provided by Europol to Have I Been Pwned.
