Data & Leads Data Breach

What happened?

In November 2018, security researcher Bob Diachenko identified an unprotected database believed to be hosted by a data aggregator . Upon further investigation, the data was linked to marketing company Data & Leads . The exposed Elasticsearch instance contained over 44M unique email addresses along with names, IP and physical addresses, phone numbers and employment information. No response was received from Data & Leads when contacted by Bob and their site subsequently went offline.

When did it happen?

The breach date in the public record is November 14, 2018. The record was added to the catalogue on November 28, 2018 and last updated there on November 28, 2018.

What information was reported as exposed?

• Email addresses
• Employers
• IP addresses
• Job titles
• Names
• Phone numbers
• Physical addresses

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with Data & Leads or used datanleads.com around November 14, 2018. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.