Lead Hunter data breach: what happened and what to do
In March 2020, a trove called Lead Hunter was found on a publicly facing Elasticsearch server. It holds 68,693,853 accounts: email addresses, names, phone numbers, physical addresses, genders and IP addresses. Nobody has been identified as responsible.
View all 13,115 breaches- Breach date
- 4 Mar 2020
- Affected
- 68,693,853
- Data exposed
- Email addresses, Genders, IP addresses, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In March 2020, a very large set of personal data known as Lead Hunter was found sitting on a publicly facing Elasticsearch server, a type of database server that was left open to the internet. It was passed to Have I Been Pwned (HIBP), which added it in June 2020. HIBP counts 68,693,853 accounts, about 69 million unique email addresses, across 110 million rows of data.
At the time of publishing, the breach couldn't be attributed to whoever collected and exposed it. Troy Hunt, who runs HIBP, wrote about this in The unattributable Lead Hunter data breach. You may never have heard of Lead Hunter, which is typical of data collected for marketing and lead generation.
What was exposed
Besides email addresses, the data has names, phone numbers, genders, IP addresses and physical addresses. No passwords are listed in the data.
That mix is what makes it useful to scammers. A name, address and phone number together make a phishing email or a text feel personal, and they help someone impersonate you when calling a company. Phone numbers also feed spam calls and SIM swap attempts, where a criminal tries to talk your carrier into moving your number to their SIM.
What the company said
There's no company statement because no company was identified as the source. HIBP's entry and Troy Hunt's write-up are the sources for the numbers and data types.
What to do if you were in it
- 1
Expect personal-sounding phishing and scam calls
Messages may use your real name, address or phone number. Don't click links or give details to someone who contacts you first. Hang up and call the company on its official number.
- 2
Lock down your phone number with your carrier
Ask your carrier to add a PIN or port-out lock to your account, which makes a SIM swap harder.
- 3
Use unique passwords and two-factor login
No passwords leaked here, but your email address is out. Use a unique password and an authenticator app on your email, since email resets everything else.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak. It can't remove data that has already leaked.
Frequently asked
Was I affected by the Lead Hunter data breach?
Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 68,693,853 accounts.
What was exposed?
Email addresses, names, phone numbers, genders, IP addresses and physical addresses.
Who was behind the Lead Hunter breach?
Nobody has been identified. HIBP says the breach couldn't be attributed at the time of publishing.
Should I change my password?
No passwords were in the data, but use a unique one on your email and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
