The San Diego Zoo Breach Exposed 67,392 Email Addresses Online

HEROIC analysts identified 67,392 exposed email addresses tied to San Diego Zoo, a breach dated November 7, 2014. Unlike many breaches in HEROIC's database, this incident did not expose passwords. HEROIC's records confirm that no password data was included, leaving email addresses as the only confirmed exposed field.

Why an Email-Only Breach Still Carries Risk

Even without passwords, a leaked email address is useful to attackers. A large list of confirmed, active email addresses tied to a specific organization gives phishing campaigns a real edge, since attackers can craft messages that reference San Diego Zoo by name and appear far more credible than a random spam email. This breach carries less risk than one involving passwords, but it isn't risk-free.

What Was Exposed in the San Diego Zoo Breach

• Email address

HEROIC's records confirm no passwords or other data types were part of this breach.

Why This Matters for San Diego Zoo Contacts

An exposed email address alone won't let an attacker log into your accounts, but it can fuel targeted phishing emails designed to trick you into giving up a password or clicking a malicious link. If you receive an unexpected email referencing a San Diego Zoo account, membership, or ticket purchase, treat it with extra caution before clicking any links or entering any information.

How This Database Breach Happened

This incident is classified as a database breach, meaning attackers gained direct access to a database containing San Diego Zoo email addresses rather than collecting data through malware. Even when a database breach exposes a single field like email addresses, it typically means an attacker found a way into the underlying systems, whether through an unpatched vulnerability, a misconfigured server, or compromised credentials, and was able to export data directly.

Check If You Are Affected by the San Diego Zoo Breach

You don't need to guess whether your email was part of the San Diego Zoo breach or any other leak. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records and shows you exactly what was exposed. If you find a match, change the password on any account still using it and enable multi-factor authentication where you can.