ApexSMS Data Breach (2019): What Was Exposed & What To Do

Data exposures involving large-scale SMS operations continue to surface as organizations collect contact information at volume for messaging services. The ApexSMS incident, reported in 2019, involved the exposure of records belonging to an operation that sent bulk SMS messages, highlighting how even specialized service providers can become vectors for personal data leakage when basic security controls are absent.

Public reporting placed the number of affected individuals at 23.2 million, with more than 80 million records containing email addresses, names, phone numbers, telecommunications carriers, geographic locations, genders, and IP addresses. The incident was identified after an unprotected MongoDB instance was found online.

Inside the incident

The breach came to light when researchers located a MongoDB database named ApexSMS that required no password for access. News of the discovery emerged in May 2019, although the incident itself is dated to 2019. The exposed instance contained over 80 million records tied to 23.2 million unique email addresses. The data included names, phone numbers and carriers, state and country locations, genders, and IP addresses. No further technical details on the duration of exposure or the method of initial access have been publicly confirmed.

How a breach like this happens

Incidents involving exposed databases often begin with a misconfigured instance left reachable from the public internet without authentication. In the case of document-oriented databases such as MongoDB, default settings sometimes permit open access if administrators do not explicitly enable access controls or bind the service to localhost. Once discovered through automated scanning, such databases can be read in full without triggering conventional intrusion alerts. The absence of encryption at rest or network segmentation can further increase the volume of data that becomes immediately readable.

Who is ApexSMS?

ApexSMS operated as a bulk SMS service, a category of provider that transmits large volumes of text messages on behalf of clients. Organizations in this sector routinely process telephone numbers, associated names, and carrier information to route messages and comply with telecommunications rules. They may also retain email addresses for account management and IP addresses for logging delivery attempts. Because these services sit at the intersection of marketing, customer notification, and mobile infrastructure, a compromise can reveal contact patterns across wide populations.

What data was at risk

The records publicly associated with the incident contained email addresses, names, phone numbers, telecommunications carriers, geographic locations at state and country level, genders, and IP addresses. No information has been released about the presence or absence of additional fields such as message content, timestamps, or account credentials. The exact scope of data accessed by any third party therefore remains unconfirmed beyond the categories listed in contemporaneous reports.

Why it matters

Phone numbers paired with carrier details can facilitate targeted messaging or SIM-swapping attempts, while email addresses and names support phishing campaigns that reference known contacts. Geographic and IP data can narrow the targeting of further attacks. For the organization, the exposure underscores the operational requirement to secure any database that stores customer routing information, regardless of whether the service itself is viewed as high-value infrastructure.

Were you affected?

Individuals who suspect their information may have been included can begin by monitoring email accounts for unexpected messages that reference the exposed phone numbers or carriers. Changing passwords on any services that reuse those email addresses and enabling multi-factor authentication where available reduces immediate follow-on risk. Running a free exposure scan of the email address against known breach datasets provides a starting point for determining whether the address has appeared in public listings of this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.