Data & Leads Data Breach (2018): What Was Exposed & What To Do

In November 2018, security researcher Bob Diachenko discovered an unprotected Elasticsearch database containing records linked to the marketing company Data & Leads. The incident involved more than 44.3 million unique email addresses along with associated personal and professional details. The database was reported on November 14, 2018, after which the company’s site went offline. No official statement from Data & Leads has been recorded in connection with the discovery. This event illustrates how large repositories of contact and employment data can be left accessible without authentication, exposing individuals whose information is aggregated for commercial use.

Inside the incident

The database was identified as an exposed Elasticsearch instance. It held over 44.3 million unique email addresses together with names, IP addresses, physical addresses, phone numbers, employers, and job titles. Diachenko attributed the data to Data & Leads after examining its contents. Attempts to contact the company received no response. The site associated with Data & Leads subsequently became unavailable. No further details on the duration of exposure or the total volume of records beyond the reported unique emails have been made public.

How a breach like this happens

Incidents involving exposed databases often stem from configuration errors that leave services reachable over the public internet without access controls. Elasticsearch instances, in particular, have historically been deployed with default settings that do not require authentication. When such a service indexes records collected from multiple sources, the entire dataset becomes readable by anyone who locates the open port. These exposures are typically discovered by researchers scanning for misconfigured systems rather than through deliberate intrusion into protected networks.

About Data & Leads

Data & Leads operated as a data aggregator supplying contact and employment information to clients for marketing and lead-generation purposes. Organizations in this sector routinely compile names, addresses, phone numbers, email addresses, and workplace details from public records, commercial sources, and web scraping. The resulting datasets are used to build profiles that combine personal identifiers with professional attributes. A breach at such a firm is consequential because the information is already structured for outreach and can be repurposed without additional effort.

What was likely exposed

The Elasticsearch instance contained email addresses, names, IP addresses, physical addresses, phone numbers, employers, and job titles. These categories were directly observed in the exposed data. The precise scope of records, including whether every field was populated for all 44.3 million entries or whether additional fields existed, remains unconfirmed. Organizations of this type commonly store similar fields to support marketing activities, yet the exact contents of the dataset cannot be stated beyond what was reported by the researcher.

Why it matters

Combined personal and employment data can be used to craft targeted messages that appear legitimate, increasing the effectiveness of phishing or unsolicited contact. IP addresses paired with other identifiers may also assist in mapping online activity to specific individuals. For the organization, loss of control over its primary asset—aggregated contact records—can affect client trust and future data partnerships. Individuals whose records appeared in the dataset face the persistent risk that their details will circulate among parties who acquire exposed marketing lists.

What to do if you're exposed

Review recent account activity for any services tied to the exposed email address and enable multi-factor authentication where available. Consider using a password manager to replace reused credentials. Monitor statements from financial or government accounts for unusual activity. Readers can run a free exposure scan of their email address against known breach datasets to determine whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.