Lead Hunter data breach (2020) — what was exposed and what to do

What happened

According to public breach records, the Lead Hunter data breach on March 4, 2020 is reported to have exposed the personal information of 68,693,853 accounts.

In March 2020, a massive trove of personal information referred to as "Lead Hunter" was provided to HIBP after being found left exposed on a publicly facing Elasticsearch server. The data contained 69 million unique email addresses across 110 million rows of data accompanied by additional personal information including names, phone numbers, genders and physical addresses. At the time of publishing, the breach could not be attributed to those responsible for obtaining and exposing it. The data was provided to HIBP by dehashed.com.

In early 2020 a publicly accessible, unsecured Elasticsearch server was found exposing a large trove of marketing-lead data, which was provided to Have I Been Pwned and added on 3 June 2020 covering roughly 68.7 million unique email addresses alongside names, genders, IP addresses, phone numbers and physical addresses. The data could not be attributed to a responsible party: every record carried the generic term "leadhunter," which initially pointed at a German B2B telemarketing firm (leadhunter.com), but Troy Hunt confirmed directly with that company that the data was not theirs and that "leadhunter" is a generic term used by many sources. Analysis of individual records suggested the information had been scraped and aggregated from public sources such as WHOIS domain-registration data, in some cases years before the exposure. ["Treat the leaked email address and phone number as known to spammers and scammers — be skeptical of unsolicited marketing calls, texts, and emails, and never act on links or attachments in messages you did not request.", "Because your name, home address, and contact details were aggregated together, watch for convincing targeted phishing and impersonation attempts that cite those real details to seem legitimate.", "Consider registering your number on do-not-call lists and using email/phone filtering, since this is lead-generation data primed for marketing and robocall reuse.", "No passwords, SSNs, or payment-card data were involved, so credential or credit-freeze actions are not specifically warranted by this exposure — focus on phishing and spam vigilance."]

What data was exposed

The following types of personal data were compromised:

• Email addresses
• Genders
• IP addresses
• Names
• Phone numbers
• Physical addresses

Breach details

This summary is compiled from public breach-notification data and known leak databases. Figures reflect what those sources report and may be revised as more is learned. If something here looks wrong or you think your information is involved, contact our support team.

We report breaches as a factual record to help people check their exposure. Inclusion here is not an allegation of wrongdoing or negligence by Lead Hunter; it reflects a publicly reported security incident.

What to do now

Based on the data exposed in this breach, here are the steps you should take:

• Treat the leaked email address and phone number as known to spammers and scammers — be skeptical of unsolicited marketing calls, texts, and emails, and never act on links or attachments in messages you did not request.
• Because your name, home address, and contact details were aggregated together, watch for targeted phishing and impersonation attempts that cite those real details to appear legitimate.
• Consider registering your phone number on do-not-call lists and enabling email/phone spam filtering, since this is lead-generation data primed for marketing and robocall reuse.
• No passwords, SSNs, or payment-card data were involved, so credential changes and credit freezes are not specifically warranted by this exposure — focus on phishing and spam vigilance.

Check your exposure

Data breaches are one of the ways your personal information ends up on data broker sites. Run a free scan to see which sites are exposing your personal data — and take action to remove it.

Sources

• Troy Hunt: The Unattributable "Lead Hunter" Data Breach
• Have I Been Pwned: Lead Hunter Data Breach