Lead Hunter data breach: 68.7M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2020-06-03
In March 2020, a massive trove of personal information referred to as "Lead Hunter" was provided to HIBP after being found left exposed on a publicly facing Elasticsearch server. The data contained 69 million unique email addresses across 110 million rows of data accompanied by additional personal information including names, phone numbers, genders and physical addresses. At the time of publishing, the breach could not be attributed to those responsible for obtaining and exposing it. The data was provided to HIBP by dehashed.com. Exposed data: email addresses, genders, ip addresses, names, phone numbers, physical addresses. The breach dates from Mar 4, 2020; Have I Been Pwned loaded it on Jun 3, 2020.
What to do
- If you had a Lead Hunter account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
