Modern Business Solutions data breach (2016) — what was exposed and what to do

We publish these pages from public notices and reporting so you can understand what was exposed. Everything here is already public. Always confirm with the organization named in your notice.

What happened

According to public breach records, the Modern Business Solutions data breach on October 8, 2016 is reported to have exposed the personal information of 58,843,488 accounts.

In October 2016, a large Mongo DB file containing tens of millions of accounts was shared publicly on Twitter (the file has since been removed). The database contained over 58M unique email addresses along with IP addresses, names, home addresses, genders, job titles, dates of birth and phone numbers. The data was subsequently attributed to "Modern Business Solutions", a company that provides data storage and database hosting solutions. They've yet to acknowledge the incident or explain how they came to be in possession of the data.

In October 2016, a database belonging to Modern Business Solutions — a data storage and database-hosting provider — was exposed because a MongoDB installation was left accessible on the internet without authentication; security firm Risk Based Security traced the leaked archive back to the company by its IP address. A hacker using the Twitter handle @0x2Taylor publicly released the data, initially surfacing at least 58 million records (names, dates of birth, email and postal addresses, phone numbers, job titles, IP addresses, and vehicle data), with analysis suggesting the underlying tables could hold as many as 258 million rows. Because the firm held this data on behalf of its own business customers, most affected individuals had no direct relationship with the company and were unaware their information was stored there. In October 2016, a database belonging to Modern Business Solutions — a data storage and database-hosting provider — was exposed because a MongoDB installation was left accessible on the internet without authentication; security firm Risk Based Security traced the leaked archive back to the company by its IP address. A hacker using the Twitter handle @0x2Taylor publicly released the data, initially surfacing at least 58 million records (names, dates of birth, email and postal addresses, phone numbers, job titles, IP addresses, and vehicle data), with analysis suggesting the underlying tables could hold as many as 258 million rows. Because the firm held this data on behalf of its own business customers, most affected individuals had no direct relationship with the company and were unaware their information was stored there.

What data was exposed

The following types of personal data were compromised:

• Dates of birth
• Email addresses
• Genders
• IP addresses
• Job titles
• Names
• Phone numbers
• Physical addresses

Breach details

This summary is compiled from public breach-notification data and known leak databases. Figures reflect what those sources report and may be revised as more is learned. If something here looks wrong or you think your information is involved, contact our support team.

We report breaches as a factual record to help people check their exposure. Inclusion here is not an allegation of wrongdoing or negligence by Modern Business Solutions; it reflects a publicly reported security incident.

What to do now

Based on the data exposed in this breach, here are the steps you should take:

• Treat your email address and phone number as known to attackers: be skeptical of unsolicited messages, and verify any request that references your name, birth date, or home address before acting on it.
• Because full name, date of birth, and physical address were exposed together — a common identity-verification combination — consider placing a fraud alert or credit freeze and watch for accounts or services opened in your name.
• Watch for tailored phishing and pretexting that cites your job title or employer, since occupation data was part of this exposure.
• No passwords or financial card numbers were in this dataset, but if you reused the exposed email for logins, enable two-factor authentication on those accounts as a precaution.