Public Business Data data breach: 27.9M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2023-10-09
In approximately August 2021, hundreds of gigabytes of business data collated from public sources was obtained and later published to a popular hacking forum. Sourced from a customer of Bureau van Dijk's (BvD) "Orbis" product, the corpus of data released contained hundreds of millions of lines about corporations and individuals, including personal information such as names and dates of birth. The data also included 28M unique email addresses along with physical addresses (presumedly corporate locations), phone numbers and job titles. There was no unauthorised access to BvD's systems, nor did the incident expose any of their or parent company's Moody's clients. Exposed data: dates of birth, email addresses, job titles, names, phone numbers, physical addresses. The breach dates from Aug 19, 2021; Have I Been Pwned loaded it on Oct 9, 2023.
What to do
- If you had a Public Business Data account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
