AerServ Data Breach (2018): What Was Exposed & What To Do

In April 2018 the advertising technology company AerServ experienced a data breach that exposed records belonging to approximately 66,000 individuals. The incident came to wider public attention later that year when the data appeared on Twitter; InMobi, which had acquired AerServ earlier in 2018, stated at that time that it was already aware of the event. The breach involved email addresses together with additional contact details and passwords stored as salted SHA-512 hashes.

Inside the incident

Public records indicate that the breach occurred around April 2018. The compromised records contained more than 66,000 unique email addresses along with names, phone numbers, physical addresses, employers and job titles. Passwords were present in salted SHA-512 form. No further technical details about the method of intrusion, the precise date range of access, or the volume of data exfiltrated have been disclosed in available reporting.

The data set was posted publicly on Twitter later in 2018. After the posting, InMobi confirmed awareness of the incident. No additional statements regarding containment steps or subsequent findings have been released in the sources examined.

How a breach like this happens

Incidents involving advertising platforms often begin with the compromise of internet-facing systems such as web applications, APIs or administrative interfaces. Attackers may exploit unpatched software, weak authentication controls or misconfigured cloud storage to obtain database access. Once inside, they can copy tables that store user and customer records.

After extraction, data sets are sometimes shared or sold on forums and social media. In this case the material appeared on Twitter months after the initial compromise window, a pattern seen when stolen information circulates before surfacing publicly. The use of salted SHA-512 hashing for passwords reflects a common, though not unbreakable, approach to storing credentials at rest.

About AerServ

AerServ operated as an ad-management platform within the digital advertising sector. Companies in this field routinely maintain databases of publisher and advertiser contacts to facilitate campaign delivery, billing and reporting. Such records commonly include professional identifiers and authentication material that allow platform users to manage accounts.

The acquisition of AerServ by InMobi earlier in 2018 placed the affected systems under new ownership at the time the breach was later disclosed. Advertising technology firms hold data that can reveal professional networks and communication channels, making any exposure of these records a matter of routine security interest for the organisations and individuals involved.

The information in question

The records reported as exposed include email addresses, names, phone numbers, physical addresses, employers and job titles. Passwords were stored as salted SHA-512 hashes. No confirmation has been provided on whether additional fields such as financial details or internal system logs were also present in the data set.

Because the exact contents of every record remain unverified beyond the categories listed above, it is not possible to state with certainty which individuals had every field populated. Organisations of this type typically retain contact information sufficient to conduct business relationships, yet the precise scope for any given account is not publicly documented.

The real-world impact

Individuals whose email addresses, phone numbers and physical addresses appear in the data may receive unsolicited messages or be targeted in phishing campaigns that reference their professional roles. Passwords stored as salted hashes require additional computational effort to recover, but any reused credentials could still be tested against other services.

For the organisation, the incident adds to the body of known compromises in the advertising technology sector. InMobi’s acknowledgment indicates the matter was treated as a known event once the data surfaced publicly, though the absence of further disclosed metrics leaves the full operational consequences unquantified.

What to do if you're exposed

Recipients of breach notifications should change passwords on any account that reuses the exposed credential and enable multi-factor authentication where available. Monitoring email and phone channels for unexpected contact, and verifying the legitimacy of messages that reference the listed employers or job titles, reduces the chance of successful follow-on attempts.

Readers can run a free exposure scan of their email address against known breach data sets to determine whether their information appears in this or other publicly reported incidents. Keeping software updated and reviewing privacy settings on professional platforms provide ongoing, practical steps that limit future exposure.

AICompiled with AI assistance from public sources and published under our editorial standards.