Apollo apollo.io Apollo data breach: what happened and what to do
In July 2018, Apollo's sales database was left publicly exposed. Have I Been Pwned counts 125,929,660 accounts with email addresses, names, employers, job titles, phone numbers, locations and social media profiles. Apollo said passwords and financial data were not included.
View all 13,115 breaches- Breach date
- 23 Jul 2018
- Made public
- 5 Oct 2018
- Affected
- 125,929,660
- Data exposed
- Email addresses, Employers, Geographic locations, Job titles, Names, Phone numbers, Salutations, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Apollo (apollo.io) sells sales intelligence: a database of business contacts that sales teams use to find people to email and call. Have I Been Pwned (HIBP) dates its breach to July 23, 2018 and added it to its database on October 5, 2018.
What happened
Apollo left a database containing a very large amount of contact data publicly accessible without a password. A security researcher found it and passed a subset to HIBP. Apollo reported the incident to its customers in early October 2018. So this wasn't a hack in the usual sense: nobody had to break in, because the data was open.
Press coverage at the time described a database of around 200 million contact records. HIBP's copy holds 125,929,660 unique accounts, and that is the figure this page uses.
Why you might be in it without ever using Apollo
Most people in this file never signed up for anything. Apollo's business is gathering professional contact details and selling access to them. If you have a work email, a LinkedIn profile or a public job title, you may be in a database like this without having agreed to it.
That's why this breach is a good example of how data brokers work. The data was collected about you, not from you.
What was exposed
HIBP lists these data types:
- Email addresses
- Names and salutations
- Employers and job titles
- Phone numbers
- Geographic locations
- Social media profiles
Apollo said the exposed data didn't include passwords, Social Security numbers or financial details.
What criminals can do with it
Work contact data is what makes business scams believable. A criminal who knows your employer, your job title and who you report to can write a fake invoice request or a "CEO needs gift cards" message that looks routine. Phone numbers add voice phishing to the mix.
It also helps with spam. Once a work email is in a file like this, it's circulated among marketers and scammers alike.
Apollo's response
Apollo notified customers in October 2018, as reported by press at the time. The sources used here don't describe a settlement.
Serus can't remove data from a breach file that's already been copied. It can find the data brokers that operate where you live and ask them to remove you, and it monitors breach databases and the dark web for your details so you hear about new exposure quickly. The steps below are the ones that matter for this breach.
How to check your own exposure
Search your email address on Have I Been Pwned, which is free and doesn't ask for a password. Try any older or secondary addresses too, since people forget the ones they used years ago.
What to do if you were in it
- 1
Be suspicious of work requests that quote your role
Scammers who know your employer and job title write convincing fake requests from bosses, vendors and recruiters. Confirm unusual requests, especially for payments or gift cards, through a second channel.
- 2
Expect more sales spam and phishing
A work email in this file will keep getting targeted. Use your mail provider's filtering, and report phishing at work to your IT or security team.
- 3
Be careful with unexpected calls and texts
Your phone number was exposed with your name and employer. Don't confirm details to a caller you didn't contact. Hang up and call back using an official number.
- 4
Use two-factor authentication on work and personal accounts
Contact details help attackers target you, so make a stolen password worthless with an authenticator app or security key.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about new exposures without searching for them.
Frequently asked
Was I affected by the Apollo breach?
Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 125,929,660 accounts.
What was exposed?
Email addresses, names, employers, job titles, phone numbers, locations, salutations and social media profiles, according to HIBP.
Do I need to change my password?
Apollo said passwords weren't in the exposed data, so no. The risk is phishing that uses your work details.
Is there a settlement?
None of the sources used for this page report a settlement.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
