291,000 users affected by a claimed leak at SongTrivia2.io

On 3 April 2026, SongTrivia2 — an online music trivia game where players guess songs and compete against one another — was reported to have suffered a data breach after its database was published on a public cybercrime forum by a threat actor going by "punk". The data was loaded into Have I Been Pwned on 4 April 2026, with the breach itself dated to April 2026.

The leaked database held approximately 291,000 unique accounts (cited precisely as 291,739). It covered both users who registered directly on the site and those who signed in via Google OAuth; directly created accounts also included passwords stored as bcrypt hashes.

Exposed data categories included:

• Email addresses
• Names and usernames
• Avatars
• Authentication tokens
• Passwords (bcrypt hashes, for directly created accounts)

The breach appears to be a straightforward database exfiltration later traded on a hacking forum. SongTrivia2 has not publicly detailed the root cause or any remediation measures, so the status remains unknown.