<ul data-eligibleForWebStory="true">Email hosting provider Cock.li, known for its popularity among hackers, has been hacked, compromising sensitive data of over a million users.A threat actor is selling two Cock.li databases on the dark web, containing email addresses, login details, contact information, and user preferences.Cock.li confirmed the authenticity of the leaked data and urged users to change their passwords.The hacker exploited a vulnerability in Cock.li's Roundcube webmail platform, affecting users who logged in since 2016.Sensitive information of approximately 1,023,800 users and 10,400 contact entries were compromised in the breach.The stolen data includes email addresses, login timestamps, preferences, names, emails, vcards, and comments.Passwords, emails, IP addresses, and data of non-webmail users were reportedly not compromised in the breach.Cock.li, a German email provider focusing on privacy, decided to abandon Roundcube due to an exploited remote code execution flaw.After the breach, Cock.li experienced disruptions and the databases were put up for sale on the dark web for one bitcoin.Cock.li admin team advised users to update their passwords as a precautionary measure.