Data Enrichment Records Data Breach (2016): What Was Exposed & What To Do
SourceBreach data provided in part by Have I Been Pwned, used under CC BY 4.0.
The Data Enrichment Records Data Breach (2016) (reported December 23, 2016) exposed Buying preferences, Charitable donations, Credit status information and Dates of birth belonging to roughly 8.2M people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
Breaking down the breach
The breach came to light when the profiles were placed for sale on underground markets. Public reporting at the time identified more than 200 million profiles in the offering, though the number of distinct individuals tied to unique email addresses was stated as 8.2 million. No official statement from Data Enrichment Records detailing the method of acquisition, exact volume of records taken, or timeline of the incident has been recorded in available accounts. The precise circumstances under which the data left its original location remain undisclosed.
How a breach like this happens
Incidents involving large collections of personal profiles often begin with unauthorized access to systems that store or process aggregated data. This can occur through remote exploitation of software vulnerabilities, compromised credentials, or direct extraction by someone with internal access. Once obtained, the data may be packaged and offered on hidden marketplaces. In cases where the source is not immediately confirmed, the records can still be validated by matching known fields against other public or commercial datasets.
Who is Data Enrichment Records?
Data Enrichment Records operates in the data aggregation sector, compiling detailed profiles that combine basic contact information with attributes such as purchasing habits and financial indicators. Organizations in this field typically supply data to marketers, researchers, and other businesses seeking to supplement their own records. A breach at such an entity is consequential because the profiles are designed to be comprehensive, increasing the potential reach of any exposed information across multiple downstream uses.
The information in question
The exposed records included buying preferences, charitable donations, credit status information, dates of birth, email addresses, family structure, financial investments, and home ownership statuses. These categories align with the types of fields commonly maintained by data enrichment services. No further confirmation of additional data elements or the complete scope of records has been provided in public reports.
Why it matters
Exposure of this nature can lead to increased unsolicited contact, targeted scams, or attempts to misuse financial and household details. For individuals, the combination of email addresses with credit and ownership information raises the possibility of more precise phishing or identity-related fraud. For the organization, the incident highlights risks associated with holding large volumes of enriched personal data without corresponding public detail on protective measures in place at the time.
What to do if you're exposed
Review recent account activity for any email addresses that appear in the records and change passwords where reuse is suspected. Enable multi-factor authentication on services tied to those addresses. Monitor statements for unusual credit or financial activity. Readers can run a free exposure scan of their email to check whether their information has surfaced in known breach data.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
RankWatch Data Breach (2016)Modern Business Solutions Data Breach (2016)Justdate.com Data Breach (2016)Real Estate Mogul Data Breach (2016)Latest breaches
Read GalaxyWarden’s full analysis of the Data Enrichment Records Data Breach (2016) →
Verified breach. Breach data provided in part by Have I Been Pwned, used under CC BY 4.0.
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.