Adapt adapt.io Adapt data breach: what happened and what to do
In November 2018 an unprotected Adapt database exposed about 9.4 million records of people and their employers: names, employers, job titles, email addresses, phone numbers and physical addresses. Expect work-flavored phishing.
View all 13,115 breaches- Breach date
- 5 Nov 2018
- Affected
- 9,363,740
- Data exposed
- Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
In November 2018, security researcher Bob Diachenko found an unprotected database run by Adapt, a data aggregator that sold what it called "Fresh Quality Contacts". Have I Been Pwned (HIBP) added it on November 22, 2018 and lists it as a verified breach.
What happened
This was not a hack in the usual sense. The database sat online with no password, so anyone who found it could read it. Adapt holds business contact data, and the exposed set covered over 9.3 million individuals along with details about their employers, such as a description of the organization, its size and revenue. HIBP says Adapt didn't respond when it was contacted.
What was exposed
HIBP counts 9,363,740 accounts. The data classes are email addresses, employers, job titles, names, phone numbers, physical addresses and social media profiles. There are no passwords in this one.
You may be in it without ever having signed up. Aggregators like this collect work details from public profiles, conference lists and other sources, then sell access to sales teams.
What that lets criminals do
A clean list of names, job titles, employers and work emails is what business email scams run on. A message that says it's from your CEO or your supplier, and gets your title right, is much harder to spot. The phone numbers and addresses also work for text scams and for matching your records with other leaked data.
What to do now
No password to reset here, so the work is about spotting scams. Be careful with unexpected requests that mention your job or employer, especially anything about payments or gift cards. If you receive many sales calls and emails, it may also be worth removing yourself from the data brokers that sell this kind of contact data.
What to do if you were in it
- 1
Treat unexpected work requests with suspicion
Messages that name your job title or employer and ask for money, gift cards or a login are a classic scam. Check by phone using a number you already have.
- 2
Don't click links in messages that mention the breach
Go to the company's site yourself. Criminals send fake breach alerts.
- 3
Tell your IT or security team about targeted phishing
If you receive convincing messages that use your job details, forward them to whoever handles security at work.
- 4
See which other breaches include you
Run a free Serus scan to see which other breaches include your email or phone.
Frequently asked
Was I affected by the Adapt breach?
If your work details were in sales contact lists in 2018, possibly. Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 9,363,740 accounts.
What was exposed in the Adapt breach?
Names, employers, job titles, email addresses, phone numbers, physical addresses and social media profiles.
Were passwords exposed?
No. HIBP lists no passwords for this breach.
Should I change my password?
Not because of this breach, since no passwords were in it. Do change any password you reuse across sites.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
