Exactis Data Breach

What happened?

In June 2018, the marketing firm Exactis inadvertently publicly leaked 340 million records of personal data . Security researcher Vinny Troia of Night Lion Security discovered the leak contained multiple terabytes of personal information spread across hundreds of separate fields including addresses, phone numbers, family structures and extensive profiling data. The data was collected as part of Exactis' service as a "compiler and aggregator of premium business & consumer data" which they then sell for profiling and marketing purposes. A small subset of the exposed fields were provided to Have I Been Pwned and contained 132 million unique email addresses.

When did it happen?

The breach date in the public record is June 1, 2018. The record was added to the catalogue on July 25, 2018 and last updated there on July 25, 2018.

What information was reported as exposed?

• Credit status information
• Dates of birth
• Education levels
• Email addresses
• Ethnicities
• Family structure
• Financial investments
• Genders
• Home ownership statuses
• Income levels
• IP addresses
• Marital statuses
• Names
• Net worths
• Occupations
• Personal interests
• Phone numbers
• Physical addresses
• Religions
• Spoken languages

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with Exactis or used exactis.com around June 1, 2018. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.