Not SOCRadar data breach (2024) — what was exposed and what to do

What happened

According to public breach records, the Not SOCRadar data breach on August 3, 2024 is reported to have exposed the personal information of 282,478,425 accounts.

In August 2024, over 332M rows of email addresses were posted to a popular hacking forum. The post alleged the addresses were scraped from cybersecurity firm SOCRadar, however an investigation on their behalf concluded that "the actor merely utilised functionalities inherent in the platform's standard offerings, designed to gather information from publicly available sources". There is no suggestion the incident compromised SOCRadar's security or posed any risk to their customers. In total, the data set contained 282M unique addresses of valid email address format.

In August 2024, a dataset of roughly 332 million rows containing 282 million unique email addresses (email addresses only, no passwords or other personal data) was posted to a hacking forum, where the person sharing it claimed the records had been taken from cybersecurity firm SOCRadar. SOCRadar investigated and concluded there was no breach of its internal systems or customer data, stating the actor "merely utilised functionalities inherent in the platform's standard offerings, designed to gather information from publicly available sources" — with the addresses scraped from public sources such as Telegram channels rather than exfiltrated from SOCRadar. Have I Been Pwned listed the data under the name "Not SOCRadar" to reflect this dispute, and found that 81% of the addresses had already appeared in prior exposures.

What data was exposed

The following types of personal data were compromised:

• Email addresses

Breach details

This summary is compiled from public breach-notification data and known leak databases. Figures reflect what those sources report and may be revised as more is learned. If something here looks wrong or you think your information is involved, contact our support team.

We report breaches as a factual record to help people check their exposure. Inclusion here is not an allegation of wrongdoing or negligence by Not SOCRadar; it reflects a publicly reported security incident.

What to do now

Based on the data exposed in this breach, here are the steps you should take:

• Treat your email address as publicly known and be alert for a rise in phishing emails and spam; verify sender addresses and avoid clicking links or attachments in unexpected messages.
• Because exposed emails are often combined with passwords from other leaks for credential stuffing, enable two-factor authentication on important accounts such as email, banking, and social media.
• Use a unique password for each account so a leaked address cannot be paired with a reused password to access your logins.
• Consider an email alias or filtering rules for high-risk signups to limit future spam and phishing aimed at this address.

Check your exposure

Data breaches are one of the ways your personal information ends up on data broker sites. Run a free scan to see which sites are exposing your personal data — and take action to remove it.

Sources

• Have I Been Pwned: Not SOCRadar Data Breach
• Have I Been Pwned on X: 282M addresses allegedly scraped from SOCRadar