Straffic straffic.io Straffic data breach: what happened and what to do
In February 2020 the Israeli marketing company Straffic exposed a database of 140GB. HIBP counts about 49 million unique email addresses, along with names, phone numbers, physical addresses and genders. Most affected people never dealt with Straffic directly.
View all 13,115 breaches- Breach date
- 14 Feb 2020
- Affected
- 48,580,249
- Data exposed
- Email addresses, Genders, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In February 2020, the Israeli marketing company Straffic left a large database reachable by outsiders. Tripwire reported about 140GB of personal data in an Elasticsearch database. Have I Been Pwned (HIBP) found over 300 million rows containing 48,580,249 unique email addresses.
What was exposed
The data included email addresses, names, phone numbers, physical addresses and genders. You probably never signed up with Straffic. Marketing firms buy and collect contact lists, so your details can end up in a database like this without you ever knowing the company exists.
How it happened
Reporting says the database was password protected, but the password sat in plain text in a configuration file on another web server linked to the company. Anyone who found the file could log in.
What this means for you
A list of names, phone numbers and home addresses is a ready-made target list for scam calls, texts and mail. The info is also the kind people-search sites collect, so it can sit next to your other public records.
The company's response
AWS confirmed on February 20 that the database had been secured. In its disclosure message, Straffic said "it is impossible to create a totally immune system, and these things can occur". It said it had patched a weakness and found no evidence of misuse.
What to do if you were in it
- 1
Expect phishing that uses real details
With your name, phone number and address in circulation, scammers can send emails or texts that look personal. Don't click links in unexpected messages, and go to the company's site directly instead.
- 2
Be wary of calls and texts that know your name
Scammers who have a name and number often pretend to be a bank, delivery firm or tax office. Hang up and call the number on your card or the official site instead.
- 3
Use a separate email for sign-ups
An alias or second address for newsletters and marketing forms keeps your main inbox out of lists like this one.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak.
Frequently asked
Was I affected by the Straffic breach?
HIBP lists 48,580,249 unique email addresses. You may be in it without having heard of Straffic. Search your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the Straffic breach?
Email addresses, names, phone numbers, physical addresses and genders. HIBP doesn't list passwords or payment details.
Do I need to change my password after the Straffic breach?
No passwords were listed, so a change isn't required because of this breach. Expect more spam and phishing, though.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
