Crunchbase crunchbase.com Crunchbase data breach: what happened and what to do
In January 2026, Crunchbase was targeted in an extortion attempt and stolen data was published. Have I Been Pwned counts about 560,000 email addresses, mostly leads and business contacts, with names, phone numbers, addresses, job titles and employers. Crunchbase confirmed the intrusion.
View all 13,115 breaches- Breach date
- 22 Jan 2026
- Affected
- 559,908
- Data exposed
- Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In January 2026, the company intelligence platform Crunchbase was targeted in a "pay or leak" extortion attempt. The data was then published online. Crunchbase later confirmed that a threat actor had taken documents from its corporate network, said the incident was contained and that it had brought in outside cybersecurity specialists and notified federal law enforcement. Have I Been Pwned added the data in October 2026.
What was exposed
Have I Been Pwned counts about 560,000 unique email addresses, largely belonging to sales leads and business contacts rather than paying members. The records also held names, physical addresses, phone numbers, job titles, employers and social media profiles. Other reports say the leak included contracts and other corporate documents.
What it means for you
Work details are what make phishing believable. A message that gets your name, your job title and your employer right looks like it came from a colleague or a vendor. Expect fake invoices, partnership pitches and "your account needs verification" emails aimed at people in your role. A phone number can be used the same way by text.
Because the data describes you professionally, the most useful targets for a scammer are people who approve payments or hold admin access at their company. If that's you, let your finance or IT team know the leak exists.
What to do
Check your email on Have I Been Pwned. If it's there, treat unexpected business messages with extra suspicion, especially ones that ask for money, gift cards or a login. Verify by calling the person on a number you already have. The leak doesn't include passwords, so there's no password you must change because of it, though a unique password per site is still the best habit.
What to do if you were in it
- 1
Verify unexpected business requests
If a colleague, vendor or recruiter asks for money, gift cards, a login or a file, confirm by calling a number you already have, not the one in the message.
- 2
Expect phishing that uses your job details
Messages may quote your job title, employer or LinkedIn profile. Those details are public in this leak, so they prove nothing about who's writing.
- 3
Warn your team
If you handle payments or admin access, tell your finance or IT team your details are out so they can double-check requests that use your name.
- 4
Watch for smishing
Your phone number was in the data. Treat texts with links, even ones that mention your company, as suspect, and don't reply.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your details and alerts you when they show up in a new leak, so you know when to repeat these steps.
Frequently asked
Was I affected by the Crunchbase breach?
Have I Been Pwned lists about 560,000 email addresses. Search yours there or run a free Serus scan.
What was exposed?
Email addresses, names, physical addresses, phone numbers, job titles, employers and social media profiles.
Were passwords exposed?
Have I Been Pwned lists no passwords in this data.
Should I change my password?
It isn't required because of this leak, but use a unique password and two-factor login on your Crunchbase account anyway.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
