Covve Data Breach (2020): What Was Exposed & What To Do

In February 2020 a dataset containing records for 22.8 million individuals was found exposed on a publicly accessible server and later supplied to Have I Been Pwned. The material originated from Covve, a contacts-management application, and included names, email addresses, phone numbers, job titles, physical addresses and social-media profiles together with recorded interactions between users and their contacts. The incident was reported on 20 February 2020 after the collection, labelled “db8151dd,” was identified by dehashed.com and forwarded to the breach-tracking service. The exposure illustrates a recurring pattern in which large volumes of personal data become available because storage systems are left reachable from the public internet without authentication. Such incidents continue to surface because organisations increasingly rely on cloud-hosted databases that, when misconfigured, require no additional compromise to be read by anyone who locates them.

What happened

The records were discovered on an Elasticsearch server that had been configured to accept connections without requiring credentials. The dataset was subsequently provided to Have I Been Pwned, which added it to its public corpus on 20 February 2020. No further technical details about the duration of exposure or the precise method of discovery have been released by the parties involved.

How a breach like this happens

Incidents involving publicly reachable databases typically begin with an administrative or development deployment that omits access controls. Once indexed by search engines or located through scanning tools, the contents can be read or copied by any party that finds the endpoint. The absence of authentication or network restrictions means no separate intrusion is required; the data is simply available until the configuration is corrected.

Covve and its sector

Covve operates a mobile application that helps users maintain and enrich their address books by pulling in contact details from multiple sources. Applications of this type routinely store names, communication identifiers and supplementary professional or location data supplied by users or imported from other services. Because the platform aggregates information about both account holders and the people they know, a single incident can affect individuals who never created a Covve account themselves.

The information in question

The material supplied to Have I Been Pwned contained email addresses, job titles, names, phone numbers, physical addresses and social-media profiles. The original report also noted that interactions between Covve users and their contacts were present. No additional categories of data have been confirmed, and the precise scope of any further records remains undisclosed.

What's at stake

Names combined with phone numbers, addresses and employment details can be used for targeted phishing, social-engineering attempts or unwanted contact. When the same records also include interaction histories, they may reveal patterns of communication that individuals would not expect to be public. For the organisation, the incident highlights the operational and regulatory consequences of storing aggregated personal data without adequate access controls.

What to do if you're exposed

Individuals can review the email addresses they have used with contact-management services and change passwords on any accounts that share those addresses. Enabling multi-factor authentication on email and social-media accounts reduces the value of the exposed identifiers to third parties. Readers may also run a free exposure scan of their email address against known breach data to determine whether their information appears in this or other public collections.

AICompiled with AI assistance from public sources and published under our editorial standards.