ai.type Data Breach (2017): What Was Exposed & What To Do

In December 2017, researchers at the Kromtech Security Center identified a large dataset belonging to the virtual keyboard application ai.type that had been left accessible on an unsecured MongoDB instance. The incident involved 577 gigabytes of data containing information on approximately 20.6 million individuals, including more than 20 million unique email addresses along with social media profiles and address book contacts. The email addresses from the dataset were later supplied to Have I Been Pwned to allow users to check their exposure. The event drew attention because the data remained publicly reachable without authentication, a configuration that permitted external discovery and potential copying of the contents.

What happened

The breach was reported on December 5, 2017. Investigators found that ai.type had stored a substantial volume of user-related records in a MongoDB deployment that lacked access controls. The exposed collection measured 577 gigabytes and included records tied to roughly 20.6 million people. Discovery occurred through external research rather than through disclosure by the company itself. No information has been released about the duration the instance remained open or the precise method by which the data first became reachable.

How a breach like this happens

Incidents involving publicly accessible databases often begin with default or misconfigured network settings on database servers. MongoDB instances, when installed without authentication requirements or without restrictions on inbound connections, can be reached by any party that locates the correct IP address and port. Once identified through automated scanning, such servers allow direct queries or bulk exports of stored collections. The absence of encryption or logging can further delay detection by the data owner.

ai.type and its sector

ai.type developed a virtual keyboard application used on mobile devices. Applications of this type routinely collect and store user inputs, device identifiers, and contact information to provide features such as predictive text and personalization. The sector handles data generated during everyday device use, including details that can link individuals to their social and professional networks. Exposure of such records therefore carries implications for both individual privacy and downstream uses of the information by third parties.

What data was at risk

The dataset contained several categories of information. The following items were identified in the exposed records:

• Address book contacts
• Apps installed on devices
• Cellular network names
• Dates of birth
• Device information
• Email addresses
• Genders
• Geographic locations

Additional references to social media profiles appeared in reporting on the incident. The exact scope of every field present in the 577-gigabyte collection remains unconfirmed beyond the categories listed above.

Why it matters

Records that combine email addresses with device details, locations, and contact lists can support targeted follow-on activity such as phishing or account enumeration. For the organization, the incident highlighted the operational consequences of storing production data without network-level protections. Individuals whose information appeared in the dataset received no direct notification from ai.type, leaving them to learn of potential exposure through secondary sources or breach-notification services.

Were you affected?

Individuals can check whether their email address appears in known breach datasets by using publicly available lookup services that index records from incidents such as this one. Practical next steps include reviewing account passwords for any services tied to the exposed email addresses and enabling multi-factor authentication where available. Monitoring for unusual login attempts or unsolicited messages that reference personal details from the records can also help limit further impact.

AICompiled with AI assistance from public sources and published under our editorial standards.