Not Acxiom data breach: what happened and what to do
In 2020 a large data set was wrongly attributed to Acxiom and circulated among hackers. Acxiom said it wasn't its data. Have I Been Pwned lists about 52 million unique email addresses, with names, phone numbers, physical addresses and IP addresses.
View all 13,177 breaches- Breach date
- 21 Jun 2020
- Affected
- 51,730,831
- Data exposed
- Email addresses, IP addresses, Names, Phone numbers, Physical addresses
- Verified
- Not verified
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
In 2020, a collection of data with almost a quarter of a billion records and over 400 different fields circulated in the hacking community. It was said to come from Acxiom, a database marketing company. Acxiom reviewed the claims and, as quoted by Have I Been Pwned, concluded they were false: the data "does not come from Acxiom and is in no way the subject of an Acxiom breach". Have I Been Pwned added the data in November 2022 under the name Not Acxiom, to make the misattribution clear.
Sources checked: haveibeenpwned.com, troyhunt.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
The data contained about 52 million unique email addresses. Have I Been Pwned lists these types of data: email addresses, names, phone numbers, physical addresses and IP addresses. The records were put together from other sources, so where it came from isn't established.
What it means for you
If your email address is in the set, someone holding it could pair your name, phone number and home address with it. That is useful for convincing phishing emails and texts, and for calls that seem to know who you are. The FTC advises not clicking links or opening attachments in unexpected messages, and contacting the company through a number or site you already know instead.
This isn't the breach of one company's customer list, so there is no single company to contact. Checking whether your email appears is the practical first step.
What to do if you were in it
- 1
Check whether your email is in this breach
Search your email address on Have I Been Pwned, or run a free Serus scan to see this and other breaches that include your email or phone number.
- 2
Expect convincing phishing and texts
Names, phone numbers and addresses can make scam messages look real. Don't click links or call numbers in unexpected messages. The FTC advises contacting the company using contact details you already trust.
- 3
Report scam messages
Forward scam emails to reportphishing@apwg.org and report texts and fraud to the FTC at ReportFraud.ftc.gov.
- 4
Use unique passwords and two-factor login
Passwords weren't listed in this data, but a leaked email address is still a target for password guessing. A password manager and two-factor login on your email account are sensible.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was Acxiom breached?
No. Acxiom reviewed the data and said it didn't come from its systems. Have I Been Pwned named the entry Not Acxiom for that reason.
What was exposed?
Email addresses, names, phone numbers, physical addresses and IP addresses, according to Have I Been Pwned.
How many people are in it?
Have I Been Pwned lists about 52 million unique email addresses.
Should I change my password?
Passwords weren't part of this data. Unique passwords and two-factor login are still good practice.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
