DemandScience by Pure Incubation data breach: 121.8M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2024-11-13
In early 2024, a large corpus of data from DemandScience (a company owned by Pure Incubation), appeared for sale on a popular hacking forum. Later attributed to a leak from a decommissioned legacy system, the breach contained extensive data that was largely business contact information aggregated from public sources. Specifically, the data included 122M unique corporate email addresses, physical addresses, phone numbers, employers and job titles. It also included names and for many individuals, a link to their LinkedIn profile. Exposed data: email addresses, employers, job titles, names, phone numbers, physical addresses, social media profiles. The breach dates from Feb 28, 2024; Have I Been Pwned loaded it on Nov 13, 2024.
What to do
- If you had a DemandScience by Pure Incubation account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
