Verifications.io data breach: what happened and what to do

Verifications.io was a company that businesses paid to check whether email addresses on their marketing lists were valid. You probably never signed up for it. Your address got there because a company that had it sent it in for checking, which is why a breach like this surprises so many people.

What happened

In February 2019, researchers Bob Diachenko and Vinny Troia found a MongoDB database that was open to the internet with no password. According to Have I Been Pwned, it exposed 763,117,241 unique email addresses. Anyone who knew where to look could read it.

The verifications.io website went offline while the disclosure was under way. An archived copy of the site is still viewable. The database was a collection of marketing lists gathered from many sources, not a single company's customer file, so there's no one customer base to point to.

What was exposed

Every record had an email address. Many also carried extra attributes: names, phone numbers, physical addresses, IP addresses, dates of birth, genders, job titles, employers and geographic locations. No passwords were in the data.

Since the data wasn't tied to one service, it describes you as a marketing target more than as an account holder. That's useful to scammers in a different way. A name, an employer and a job title make a convincing phishing email ("Hi, I'm from your company's IT team"). A phone number and date of birth feed smishing and phone scams, and help criminals pass casual identity checks.

The company's response

There was no useful public notice to customers. The site went dark during the disclosure, and the people whose data sat in the database mostly weren't the company's customers, so most of them never heard from anyone directly.

Why this one is hard to escape

You can't ask verifications.io to delete your record, because the company is gone and the data was copied while it sat open. The same details probably also sit in other marketing databases and people-search sites, which scammers use to fill in gaps. Taking your information off the sites that can still remove it makes a leaked record less useful to anyone holding it.

What to expect now

The lists are years old, but contact data ages slowly. Email addresses and phone numbers tend to stay the same for a decade. If your address was in the file, expect a steady flow of marketing spam, and sooner or later targeted phishing that uses details like your employer.

Because this breach has no passwords, there's nothing to reset on a specific account. The risk is about what scammers can do with your contact details, so the defence is caution with messages and fewer places that hold your data.