DemandScience by Pure Incubation demandscience.com DemandScience by Pure Incubation data breach: what happened and what to do
In early 2024 data from DemandScience, a company owned by Pure Incubation, went up for sale online. Have I Been Pwned counts 121,796,165 accounts: work email addresses, names, phone numbers, physical addresses, employers, job titles and social media profiles. No passwords.
View all 13,115 breaches- Breach date
- 28 Feb 2024
- Affected
- 121,796,165
- Data exposed
- Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
In February 2024, a large set of data tied to DemandScience, a B2B marketing data company owned by Pure Incubation, was offered for sale on a hacking forum. Security researcher Troy Hunt later described the listing as covering more than 180 million records. Have I Been Pwned (HIBP) added the data in November 2024 and counts 121,796,165 unique accounts.
What happened
HIBP dates the breach to 28 February 2024. The company first said its systems were fully operational, then said the data came from a decommissioned legacy system. HIBP describes the incident as a leak from that old system. DemandScience also said some older Pure Incubation data could have come from a contractor or publisher partner, but that it had no proof of that.
The data wasn't collected from people signing up to a service. DemandScience is a lead-generation business: it aggregates business contact details from public sources and sells them to marketers. Most people in the dataset never had an account with the company and have likely never heard of it.
What was exposed
HIBP lists these data types: email addresses, employers, job titles, names, phone numbers, physical addresses and social media profiles. For many people the record included a link to their LinkedIn profile. The email addresses were largely corporate ones, which is why the dataset is so heavy on work details.
No passwords or payment details are listed in the HIBP entry.
What that lets criminals do
Contact data sounds harmless next to a leaked password, but it is exactly what a phishing campaign needs. A message that knows your name, your employer and your job title reads like it came from a colleague or a vendor. Finance and HR staff are the usual targets: a fake invoice or a "please update your payroll details" email that gets your title right is far more likely to work.
Phone numbers and home or office addresses add other routes. Callers can pose as your bank or your IT team, and texts can mention your employer to seem legitimate. If your personal email or mobile number was in the data, the same applies outside work.
The social media profile links make it easier to build a picture of you from a single record. Someone can match the leak to your public profile, find your manager's name and write a convincing message in a few minutes.
The company's response
DemandScience's early statements denied a compromise, and later statements pointed to a legacy system that was no longer in use. HIBP's entry and Troy Hunt's write-up are the main public records of what the data contained. The sources below cover the timeline and the company's wording in full.
How to tell if you're affected
HIBP lets you search by email address. Because many records used work emails, check your work address as well as your personal one. If you've changed jobs since 2024, check old work addresses too.
Being in the data doesn't mean your accounts were hacked. It means your contact details were circulating, and that the people most likely to use them are phishers.
What to do if you were in it
- 1
Expect phishing that uses your details
Emails, texts and calls that mention your name, employer or phone number are more believable. Don't click links in unexpected messages. Go to the company's site yourself, and treat urgent requests for money or codes as a red flag.
- 2
Tell your employer's security team
If your work email was in the data, let IT or security know. They can warn colleagues and tighten filtering for messages that mention your title or team.
- 3
Be careful with requests for money, gift cards or login codes
Verify any unusual payment or data request by calling the person on a number you already have. Never read out a one-time code to someone who contacted you first.
- 4
Keep your public profile tight
Review what your LinkedIn and other profiles show: job title, employer, phone number and location. The less that's public, the less a scammer can match to a record like this one.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It checks breach databases for your email address and phone number and shows which breaches include you, so you know which passwords and accounts to deal with first.
Frequently asked
Was I affected by the DemandScience data breach?
Search your email address on Have I Been Pwned. Check work addresses you've used since about 2020, because the data was mostly business contact details.
What data was exposed?
HIBP lists email addresses, employers, job titles, names, phone numbers, physical addresses and social media profiles. No passwords are listed.
Should I change my password?
The entry doesn't list passwords, so a password change isn't the priority. Watch for phishing instead, and change any password you've reused if an account shows odd activity.
Why am I in the data if I never used DemandScience?
DemandScience aggregated business contact information from public sources for marketing. People in its database usually never signed up to anything.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
