LimeLeads limeleads.com LimeLeads data breach: what happened and what to do
The now-defunct B2B leads service LimeLeads left an Elasticsearch server exposed in 2019. Have I Been Pwned counts 17,838,396 accounts: business emails, phone numbers, employers, job titles and locations. No passwords.
View all 13,115 breaches- Breach date
- Aug 2019
- Affected
- 17,838,396
- Data exposed
- Email addresses, Employers, Geographic locations, Job titles, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
LimeLeads was a B2B marketing leads service: a business paid to look up contact details for people at other companies. In 2019 it left a server open to the internet, and the data on it was later offered for sale. Have I Been Pwned (HIBP) dates the breach to 1 August 2019, added it on 22 September 2026 and counts 17,838,396 unique email addresses.
What happened
HIBP says an exposed, unsecured Elasticsearch server held tens of millions of records of largely corporate contact data. Security reporting from the time says a researcher found the server and told the company in September 2019, and that it was secured within about a day. The same reporting says records were offered for sale on an underground forum and put the headline figure at 49 million records. HIBP's de-duplicated count is 17.8 million unique email addresses, and that is the number this page uses.
HIBP describes LimeLeads as now defunct. There's nobody to ask for a notice, which is part of the problem: people in the data were never customers and had no relationship with the company.
What was exposed
HIBP lists email addresses, employers, geographic locations, job titles and phone numbers. The location data covers state, city and postcode. No passwords or payment details are listed.
This is business contact data of the kind data brokers collect and resell. Many people in it didn't hand their details to LimeLeads. The company compiled them.
What that lets criminals do
A list of names, employers, job titles and phone numbers is a ready-made target list for business email compromise and spear phishing. Messages that use your real title and employer are credible, and they often impersonate a boss, a supplier or a bank.
Phone numbers invite vishing (phishing by voice call) and text scams. Sales spam is a lesser nuisance, but it also never really stops once a number is in circulation.
The location data narrows things further. A scammer can tailor a message to a city or a local branch.
Because this breach dates from 2019, some details may be out of date. Old numbers and email addresses still work often enough that the data keeps its value, so don't dismiss it because it's old.
The company's response
LimeLeads secured the server soon after being told, according to the security reporting. HIBP states the company no longer exists. The sources below cover the original reporting.
How to check
Search your email address on HIBP, work address first. If you've changed jobs since 2019, check old work addresses too, because they may still be listed.
Where to start
For most people the first move is simple: be more suspicious of work-related messages for a while. Nothing here needs a password reset. What helps is slowing down on any email or call that uses your job title, and checking requests through a channel you already trust.
What to do if you were in it
- 1
Expect phishing that uses your details
Emails, texts and calls that mention your name, employer or phone number are more believable. Don't click links in unexpected messages. Go to the company's site yourself, and treat urgent requests for money or codes as a red flag.
- 2
Warn your employer if your work email is listed
Tell IT or security, especially if you work in finance, HR or procurement. They can add warnings for messages that quote your title and team.
- 3
Verify unusual requests by another channel
If an email from a 'boss' or supplier asks for a payment, gift cards or changed bank details, call the person on a number you already have before doing anything.
- 4
Reduce how much of you brokers can sell
Data brokers collect business contact details from public sources and resell them. You can ask them to delete your record, one by one, or let Serus find the ones that list you and send the removal requests for you.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It checks breach databases for your email address and phone number and shows which breaches include you, so you know which passwords and accounts to deal with first.
Frequently asked
Was I affected by the LimeLeads breach?
Search your email address on Have I Been Pwned. It lists 17,838,396 unique email addresses.
What was exposed?
Email addresses, employers, job titles, phone numbers and locations (state, city and postcode). No passwords are listed.
Why are other sites quoting 49 million?
Early reports counted records, which included duplicates. HIBP counts 17.8 million unique email addresses.
Should I change my password?
No passwords were listed. Focus on phishing and scam calls rather than a password reset.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
