PDL data exposure: what happened and what to do
In October 2019 researchers found an unprotected Elasticsearch server with 1.2 billion records, tagged as coming from People Data Labs. Have I Been Pwned counts 622,161,052 accounts, with email addresses, phone numbers, names, job titles, employers and social media profiles.
View all 13,115 breaches- Breach date
- 16 Oct 2019
- Affected
- 622,161,052
- Data exposed
- Email addresses, Employers, Geographic locations, Job titles, Names, Phone numbers, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In October 2019, security researchers Vinny Troia and Bob Diachenko found an unprotected Elasticsearch server holding 1.2 billion records of personal data. An index in it indicated the data came from People Data Labs (PDL), a data enrichment company. Have I Been Pwned added it on 22 November 2019 and counts 622,161,052 accounts, about 622 million unique email addresses.
The server wasn't owned by PDL. HIBP says it's believed a PDL customer failed to secure the database. So this wasn't a hack of PDL itself: the data was left open to anyone who found it.
What was exposed
Email addresses, phone numbers, names, employers, job titles, geographic locations and social media profiles.
Why it matters
Data enrichment companies gather public and purchased details about people, often without those people signing up for anything. You may be in this data without ever having had an account. That's what makes it useful to scammers: a name, employer, job title and email together make convincing work-related phishing, such as a fake message from IT or HR.
Phone numbers add text-message scams to the mix.
What to do
You can't opt out of a leak that's already out, but you can make it less useful. Be careful with work-themed emails and texts, and turn on two-factor login on your email and work accounts.
What to do if you were in it
- 1
Expect work-themed phishing
Your employer and job title may be in the data. Be wary of messages from IT, HR or a boss asking for logins, gift cards or payments. Confirm through another channel.
- 2
Treat unexpected texts and calls with suspicion
Phone numbers were included. Don't tap links in unexpected texts, and hang up on calls asking for codes or account details.
- 3
Turn on two-factor login
Use an authenticator app or security key on your email and work accounts, so a leaked address alone doesn't get anyone in.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak. It can't delete breach data, but it tells you what to change.
Frequently asked
Was I affected by the PDL data exposure?
Enter your email address on Have I Been Pwned to check. A free Serus scan also checks breach databases for your email and phone.
What was exposed?
Email addresses, phone numbers, names, employers, job titles, geographic locations and social media profiles, per Have I Been Pwned.
Was People Data Labs hacked?
Have I Been Pwned says the server wasn't owned by PDL and it's believed a customer failed to secure the database.
Should I change my password?
No passwords were listed in this data. Focus on phishing and on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
