DemandScience by Pure Incubation data breach (2024) — what was exposed and what to do

What happened

According to public breach records, the DemandScience by Pure Incubation data breach on February 28, 2024 is reported to have exposed the personal information of 121,796,165 accounts.

In early 2024, a large corpus of data from DemandScience (a company owned by Pure Incubation), appeared for sale on a popular hacking forum. Later attributed to a leak from a decommissioned legacy system, the breach contained extensive data that was largely business contact information aggregated from public sources. Specifically, the data included 122M unique corporate email addresses, physical addresses, phone numbers, employers and job titles. It also included names and for many individuals, a link to their LinkedIn profile.

In February 2024 a threat actor using the handle KryptonZambie listed millions of records for sale on a hacker forum, attributing them to Pure Incubation, the former name of B2B data aggregation firm DemandScience. The full dataset was later released for a nominal fee around August 15, 2024. The exposed data was a B2B contact aggregation compiled from public and third party sources, roughly 122 million unique email addresses alongside names, employers, job titles, phone numbers, physical addresses, and links to social media profiles. When first contacted in February 2024 DemandScience said it found no indication of a breach. After security researcher Troy Hunt verified the data authenticity in November 2024 and added it to Have I Been Pwned, the company said the records came from a system decommissioned for roughly two years and that no current operational systems were exploited.

What data was exposed

The following types of personal data were compromised:

• Email addresses
• Employers
• Job titles
• Names
• Phone numbers
• Physical addresses
• Social media profiles

Breach details

This summary is compiled from public breach-notification data and known leak databases. Figures reflect what those sources report and may be revised as more is learned. If something here looks wrong or you think your information is involved, contact our support team.

We report breaches as a factual record to help people check their exposure. Inclusion here is not an allegation of wrongdoing or negligence by DemandScience by Pure Incubation; it reflects a publicly reported security incident.

What to do now

Based on the data exposed in this breach, here are the steps you should take:

• Watch for targeted phishing and spam to the exposed email address and for voice or SMS scams to the exposed phone number, since the leaked job title and employer make business themed lures more convincing.
• Treat unsolicited messages that reference your role, employer, or work contacts with suspicion, and verify any request through a known channel before acting.
• Submit a removal or opt out request to DemandScience through its data privacy contact or Do Not Sell My Information form, since this is broker aggregated contact data, and check your exposure on Have I Been Pwned.
• No passwords, payment cards, or government IDs were exposed in this incident, so credit freezes are not specifically warranted here. Focus vigilance on the email, phone, and professional details that did leak.

Check your exposure

Data breaches are one of the ways your personal information ends up on data broker sites. Run a free scan to see which sites are exposing your personal data — and take action to remove it.

Sources

• Troy Hunt: Inside the DemandScience by Pure Incubation Data Breach
• Leaked info of 122 million linked to B2B data aggregator breach (BleepingComputer)
• Have I Been Pwned: DemandScience by Pure Incubation Data Breach