Capital Economics capitaleconomics.com Capital Economics data breach: what happened and what to do
In December 2020, research firm Capital Economics had a data breach affecting about 264,000 customer records. It included names, email and physical addresses, phone numbers, job titles and employers. The company says passwords and payment details were not exposed.
View all 13,115 breaches- Breach date
- 12 Dec 2020
- Affected
- 263,829
- Data exposed
- Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Capital Economics, a London economic research firm, had a data breach in December 2020. Have I Been Pwned lists 263,829 customer records from it.
The company published a notice saying the incident happened on 12 December 2020, that unencrypted passwords and payment information were not exposed, and that it reported the incident to the UK Information Commissioner's Office on 15 December. It contacted affected people and asked them to change their passwords.
What was exposed
The records contain email addresses, physical addresses, names, phone numbers, job titles and employers. That is a business profile: who you are, where you work, what you do and how to reach you.
Criminals use that kind of data for targeted phishing. A message that names your employer and job title, and appears to come from a research provider or a colleague, is more convincing than a generic scam. Phone numbers also open the door to text scams.
What to do
If you had an account with Capital Economics, change your password anywhere you reused it, and be careful with messages that mention your job or your employer.
What to do if you were in it
- 1
Change the password, and every reuse of it
Change it on the affected service if you still have an account, then on every other account that used the same or a similar password. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey where you can. It blocks most account takeovers even when a password is already out there.
- 3
Expect phishing that uses these details
Expect emails and texts that name your employer or job title. Check the sender, and don't click links or open attachments you didn't ask for.
- 4
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak. It can't remove breach data, so the steps above are what protect you.
Frequently asked
Was I affected?
If you had a customer account with Capital Economics around December 2020, possibly. Capital Economics says it contacted affected people, and you can look up your email on Have I Been Pwned.
What was exposed?
Names, email and physical addresses, phone numbers, job titles and employers, per Have I Been Pwned. The company says unencrypted passwords and payment information were not exposed.
Should I change my password?
Yes. The company asked affected customers to change their passwords, and you should do the same anywhere you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
