Data Enrichment Exposure From PDL Customer data breach: 622.2M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2019-11-22
In October 2019, security researchers Vinny Troia and Bob Diachenko identified an unprotected Elasticsearch server holding 1.2 billion records of personal data. The exposed data included an index indicating it was sourced from data enrichment company People Data Labs (PDL) and contained 622 million unique email addresses. The server was not owned by PDL and it's believed a customer failed to properly secure the database. Exposed information included email addresses, phone numbers, social media profiles and job history data. Exposed data: email addresses, employers, geographic locations, job titles, names, phone numbers, social media profiles. The breach dates from Oct 16, 2019; Have I Been Pwned loaded it on Nov 22, 2019.
What to do
- If you had a Data Enrichment Exposure From PDL Customer account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
