Public Business Data Data Breach (2021): What Was Exposed & What To Do

In approximately August 2021, a large collection of business-related records was obtained from a customer of Bureau van Dijk’s Orbis database product and later posted on a popular hacking forum. The incident, reported on 19 August 2021, involved 27.9 million individuals and contained hundreds of gigabytes of information drawn from public sources. No unauthorised access to Bureau van Dijk’s own systems was reported.

Breaking down the breach

The published material consisted of hundreds of millions of lines describing corporations and individuals. It included names, dates of birth, email addresses (approximately 28 million unique entries), physical addresses, telephone numbers and job titles. The data had been assembled by a customer of the Orbis service rather than taken directly from Bureau van Dijk. The precise method by which the customer’s copy was obtained has not been disclosed.

How a breach like this happens

Collections of this kind are frequently assembled by organisations that aggregate publicly available records for commercial use. When such a dataset leaves its intended environment—through theft, misdirected transfer or later publication—it can be posted on forums where it circulates among interested parties. Because the material originates from open sources, the line between legitimate collection and subsequent misuse is often difficult to police once the data has left the original holder.

Public Business Data and its sector

Public Business Data appears to have functioned as a repository of commercially gathered corporate and individual records derived from public filings and directories. Organisations in this sector supply structured business intelligence to clients who require details on companies, directors and contact information. A release of this scale is consequential because the records, although individually public, become far more usable when centralised and indexed.

What was likely exposed

The published files contained names, dates of birth, email addresses, job titles, telephone numbers and physical addresses. The exact scope of every field remains unconfirmed beyond the categories already listed. No financial account details or government identifiers beyond dates of birth have been reported as present.

The real-world impact

Individuals whose records appear in the dataset face an elevated chance of receiving unsolicited contact or being targeted in social-engineering attempts that draw on their name, date of birth and employment information. For the organisation that held the data, the incident highlights the difficulty of controlling downstream copies once material has been supplied to customers. No confirmed instances of subsequent fraud directly linked to this release have been documented in the available reporting.

What to do if you're exposed

Review any recent unsolicited messages that reference your employment or personal details and treat unexpected requests for verification as suspicious. Consider enabling additional authentication steps on accounts that use the exposed email address. Readers may also run a free exposure scan of their email address against known breach datasets to determine whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.