Factual factual.com Factual data breach: what happened and what to do
In 2017 a file of 8 million rows attributed to data aggregator Factual circulated as a breach. It held 2.5 million email addresses with business names, addresses and phone numbers. Factual says the data was public business information.
View all 13,115 breaches- Breach date
- 22 Mar 2017
- Affected
- 2,461,696
- Data exposed
- Email addresses, Employers, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In March 2017, a file said to come from Factual, a location data company, was compiled and traded as if it were a breach. It held 8 million rows. Have I Been Pwned (HIBP) counts 2,461,696 unique email addresses in it, next to employers, phone numbers and physical addresses.
Was it really a breach?
Not in the usual sense. After HIBP consulted Factual, the company said the data was publicly available information about businesses and other points of interest that it publishes on its website and supplies to customers. So nobody broke into a private database. The file was a collection of listings, repackaged and passed around.
Why it still matters
The records pair an email address with a business name, address and phone number. If you run a business or list one publicly, that is the information a scammer needs for a believable invoice scam, a fake supplier call or a phishing email addressed to your company. Troy Hunt, who runs HIBP, used the case to ask what "public" data means once aggregators collect it and it spreads beyond their control.
What to do
No passwords were exposed, so there is nothing to reset. The useful steps are to expect business-themed phishing, check where your business contact details are listed, and treat unexpected calls or invoices that quote your company details with caution.
What to do if you were in it
- 1
Expect scams that quote your business details
Fake invoices, supplier calls and 'directory listing' renewals often use publicly listed names, addresses and phone numbers. Verify any unexpected request through a number you already trust.
- 2
Check how your business is listed
Search your company name and phone number and see which directories show them. Update or remove listings you don't need, and use a business address or number you can afford to publish.
- 3
Be careful with email links and attachments
Don't open unexpected attachments or click links in messages that mention your business. Go to the company's site directly instead.
- 4
Tighten the accounts tied to that email
Use a unique password and two-factor authentication on the email address you list publicly, since scammers will aim at it first.
- 5
Check whether your email is in this and other breaches
Run a free Serus scan on the email addresses and phone numbers you use. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next leak without checking by hand.
Frequently asked
Was I affected by the Factual data?
If your business email, address or phone was listed publicly in 2017, it may be in the file. HIBP lets you search your email address.
What was in the Factual file?
Email addresses, employers, phone numbers and physical addresses. Passwords and payment data are not listed in HIBP's entry.
Did Factual confirm a breach?
No. Factual told HIBP the data was publicly available business information that it publishes on its website and provides to customers.
Should I change my password?
No password was involved, so it isn't required for this data. Do it anyway on any account that shares a password with another site.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
