Speedio speedio.com.br Speedio data breach: what happened and what to do
In December 2024, data allegedly taken from the Brazilian lead generation platform Speedio was offered for sale. It held about 27.5 million unique email addresses with company names, phone numbers and physical addresses. Have I Been Pwned lists it as unverified.
View all 13,115 breaches- Breach date
- 24 Dec 2024
- Affected
- 27,501,041
- Data exposed
- Company names, Email addresses, Phone numbers, Physical addresses
- Verified
- Not verified
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In December 2024, someone offered for sale on a hacking forum data they said came from Speedio, a Brazilian lead generation platform. Have I Been Pwned (HIBP) says the data was allegedly taken from an unsecured Elasticsearch instance, a type of database server that exposes its contents when it's left open to the internet. HIBP added the data on 30 January 2025.
The set held over 62 million records, mostly public business information, and about 27.5 million unique email addresses. Many of the addresses were on public services such as Gmail and Outlook, so they belong to individuals as well as companies.
Unverified, and why that matters
HIBP lists this breach as unverified. Speedio did not respond to multiple attempts to disclose the incident, and HIBP could not independently verify where the data came from. That means the data is probably real in part, but nobody outside the company can say exactly how it was collected or whether it was leaked from Speedio's own systems. CyberInsider also reported the alleged exposure of 62 million records.
Because Speedio is a lead generation platform, much of what it held was likely gathered from public sources rather than from accounts people created. In that case, there may be no account to close and no password to change. Your details were in a business contact database.
What was exposed
HIBP lists company names, email addresses, phone numbers and physical addresses. It did not list passwords, government IDs or payment details.
What this lets criminals do
A list of email addresses with matching phone numbers and business addresses is useful to scammers because it is easy to target. Expect two things.
First, phishing. A message that references your company name or business address looks like it came from someone who knows you. Invoice scams and fake supplier emails are the common versions. Second, smishing and spam calls to the phone number in the set. Texts that claim a delivery problem or an account lock are a typical pattern.
Phone numbers also matter for SIM swap fraud, where a criminal persuades a carrier to move your number to a new SIM and then intercepts login codes. A phone number alone isn't enough to do it, but it is the starting point.
What the company has said
Speedio has not responded, according to HIBP. The facts here come from the HIBP entry and press coverage of the alleged exposure, not from a company notice.
What to do now
You can't take your details back out of a copy that is already circulating. You can make them less useful. Treat unexpected business emails and texts with suspicion, and ask your mobile carrier to add a PIN or port-out lock to your number. Details are in the steps below.
What to do if you were in it
- 1
Expect phishing that mentions your business
Be careful with unexpected invoices, supplier emails and messages that cite your company name or address. Check the sender's address and confirm requests by calling a number you already have.
- 2
Watch for texts and calls to your phone number
Delivery notices, account lock warnings and calls about your business are common scams. Don't tap links in texts. Go to the company's site directly.
- 3
Lock your phone number against SIM swaps
Ask your carrier to add an account PIN and a port-out lock. Where you can, use an authenticator app instead of text message codes for two-factor login.
- 4
Use a separate email for sign-ups
If a lot of spam arrives at one address, consider an alias for newsletters and sign-ups. It keeps your main inbox out of the next list like this.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at Serus. Serus monitors breach databases and the dark web for your email and other personal data and alerts you when something shows up. It can't remove data from a breach, so the alert tells you what to change.
Frequently asked
Was I affected by the Speedio breach?
Search your email address on Have I Been Pwned. If it appears under Speedio, your email address was in the data, possibly with a company name, phone number or address.
What was exposed in the Speedio breach?
Company names, email addresses, phone numbers and physical addresses. HIBP did not list passwords or payment details.
Is the Speedio breach confirmed?
Not fully. HIBP marks it as unverified because it could not independently confirm the origin of the data, and Speedio did not respond to its attempts to make contact.
Should I change my password?
Passwords weren't in the data, so a change isn't needed because of this breach. Do it if you reuse passwords, and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
