Malware
Exclusive: Massive Breach Exposes 122 Million Records from B2B Data Aggregator
A data breach at B2B data aggregator Apollo has exposed the personal information of 122 million people. The leak includes names, email addresses, and job titles, and could be used by cybercriminals for spear-phishing attacks or other malicious activities. Protect your personal data by staying vigilant against phishing emails and monitoring your online accounts.
Imagine your business contact information—your name, phone number, email, even your job title—floating around the internet. Now, imagine that information belonging to 122 million people being available since February 2024. That’s exactly what happened, and we’ve now confirmed it was stolen from a B2B demand generation platform.
This massive data breach occurred at DemandScience (formerly Pure Incubation), a company that aggregates data for digital marketers and advertisers. Their job is to collect, compile, and organize data from public sources and third parties, creating valuable “profiles” to generate leads and marketing information.
How the Breach Happened
In February 2024, a threat actor named ‘KryptonZambie’ began selling 132.8 million records on BreachForums, claiming the data was stolen from an exposed system belonging to Pure Incubation. When we contacted DemandScience about the alleged data theft, they denied any breach had occurred, stating that their systems were secure behind firewalls, VPN access, and intrusion detection systems.
Fast forward to August 15, 2024, and KryptonZambie made the dataset available for a mere 8 credits (a few dollars), essentially leaking the data for free.
Source: IT Services
Confirmation of the Data Breach
Today, cybersecurity expert Troy Hunt published a blog post confirming that the data is authentic. According to Hunt, someone exposed in the leak contacted DemandScience and was told that the leaked data originated from a system that had been decommissioned two years ago.
The email from DemandScience read, “We have conducted a thorough internal investigation and conclude that none of our current operational systems were exploited. We also conclude that the leaked data originated from a system that has been decommissioned for approximately two years.”
Hunt verified the authenticity of the data, even finding his own record from when he worked at Pfizer. All 122 million unique email addresses from the stolen dataset have now been added to Have I Been Pwned, and exposed subscribers will receive notifications about the breach.
Don’t Be a Victim: Stay Informed and Protected
This massive data breach serves as a stark reminder of the importance of cybersecurity. As a U.S. reader, you may not be familiar with all the ins and outs of cybersecurity, but that doesn’t mean you can’t stay informed and protected.
Keep coming back to learn more about the latest developments in cybersecurity, and don’t hesitate to contact us if you have any questions or concerns. Together, we can make the digital world a safer place.