Exactis exactis.com Exactis data breach: what happened and what to do
In June 2018, the marketing data firm Exactis left a database of about 340 million records exposed online. A small subset with 132 million unique email addresses went to Have I Been Pwned. The records covered addresses, phone numbers, family details and extensive profiling data.
View all 13,115 breaches- Breach date
- Jun 2018
- Affected
- 131,577,763
- Data exposed
- Credit status information, Dates of birth, Education levels, Email addresses, Ethnicities, Family structure, Financial investments, Genders, Home ownership statuses, Income levels, IP addresses, Marital statuses, Names, Net worths, Occupations, Personal interests, Phone numbers, Physical addresses, Religions, Spoken languages
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In June 2018, security researcher Vinny Troia of Night Lion Security found a database belonging to Exactis, a marketing firm, sitting publicly accessible on the internet. It held about 340 million records across multiple terabytes of data. Wired reported the leak. Exactis is a compiler and aggregator of consumer and business data that it sells for profiling and marketing.
This is a different kind of breach. The people in the database didn't sign up with Exactis. Their details were collected and sold by a data broker (a company that gathers personal information and sells it on).
What was exposed
Have I Been Pwned received a small subset of the exposed fields, containing 131,577,763 unique email addresses. The database held hundreds of separate fields. Listed data includes names, physical addresses, phone numbers, dates of birth and IP addresses, along with details about families, interests, income levels, net worths and religions.
What it means for you
Profiling data is useful to scammers because it lets them tailor a message to your life: your family, your interests, your finances. A phishing email that mentions your hobbies or your home ownership is more convincing than a generic one.
There's no password to change here. The useful responses are to be skeptical of well-informed unsolicited contact, and to reduce how much of this data data brokers can sell in the first place. Serus finds the data brokers that hold your information and removes it where they allow removal.
What to do if you were in it
- 1
Check whether your email is in the breach
Search your email address on Have I Been Pwned to see if it appears in the Exactis data.
- 2
Expect phishing that mentions the breach
Criminals use your name, address and personal interests to write messages that look personal. Don't click links in unexpected emails or texts about your account. Go to the site directly instead.
- 3
Treat well-informed callers with care
A caller who knows your family details or finances still might not be who they claim. Verify by calling back on an official number.
- 4
Reduce what data brokers hold on you
Brokers like this collect and resell your details. Opt out of the broker and people-search sites that list you, or let Serus find them and file the requests for you.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you if your data shows up again.
Frequently asked
Was I affected by the Exactis data breach?
Search your email address on Have I Been Pwned. You can be in the data without ever having dealt with Exactis, since it collected information from other sources.
What was exposed?
Names, addresses, phone numbers, email addresses and extensive profiling data such as family structure, interests and income levels, across about 340 million records.
Were credit cards or Social Security numbers leaked?
Reporting on the leak said credit card and Social Security numbers weren't part of the exposed data.
Should I change my password?
There were no passwords in the data, so no. Watch for targeted phishing instead.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
