Apollo data breach: 125.9M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2018-10-05
In July 2018, the sales engagement startup Apollo left a database containing billions of data points publicly exposed without a password. The data was discovered by security researcher Vinny Troia who subsequently sent a subset of the data containing 126 million unique email addresses to Have I Been Pwned. The data left exposed by Apollo was used in their "revenue acceleration platform" and included personal information such as names and email addresses as well as professional information including places of employment, the roles people hold and where they're located. Apollo stressed that the exposed data did not include sensitive information such as passwords, social security numbers or financial data. The Apollo website has a contact form for those looking to get in touch with the organisation. Exposed data: email addresses, employers, geographic locations, job titles, names, phone numbers, salutations, social media profiles. The breach dates from Jul 23, 2018; Have I Been Pwned loaded it on Oct 5, 2018.
What to do
- If you had a Apollo account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
