Elasticsearch Instance of Sales Leads on AWS Data Breach (2018): What Was Exposed & What To Do

In October 2018, a security researcher identified an exposed Elasticsearch instance hosted on AWS that held sales lead records for 5.8 million individuals. The dataset included names, email addresses, employers, and physical addresses, yet the owner of the instance could not be identified. Because the exposure involved contact and employment details that are routinely used for outreach and verification, the incident raised direct questions about how such records reach the open internet and what follow-on uses they may receive. The discovery occurred when multiple unsecured databases were located during routine scanning. One of those databases was an Elasticsearch cluster containing the sales lead material. No further technical details about the duration of exposure or the precise configuration error have been made public.

Inside the incident

On 29 October 2018 the researcher Bob Diachenko reported finding the instance among other exposed stores. The cluster contained 5.8 million unique email addresses together with associated names, employer names, and contact information. Attempts to trace the account owner were unsuccessful, leaving the collection without an attributable custodian and resulting in its public designation as the Elasticsearch Instance of Sales Leads on AWS.

How a breach like this happens

Elasticsearch instances on cloud platforms are sometimes left reachable from the public internet when access controls are not applied or when default settings remain unchanged. Once indexed data becomes discoverable, automated scanners can locate it quickly. The contents are then readable by anyone who finds the endpoint, without authentication or logging that would identify the viewer.

Elasticsearch Instance of Sales Leads on AWS and its sector

The collection appears to have been assembled for sales or marketing purposes, a common practice in sectors that maintain prospect lists. Such datasets typically aggregate publicly available or purchased contact records to support business development. When records of this type are left unprotected, the exposure affects both the individuals listed and any organisations that supplied or purchased the underlying information.

What data was at risk

The exposed fields named in the report are email addresses, names, employers, and physical addresses. The exact scope of additional fields, the original sources of the records, and whether the data had been enriched or merged with other sets remain unconfirmed because the owner of the instance was never identified.

The real-world impact

Individuals whose details appeared in the set may receive unsolicited contact or find their information reused in other lists. Organisations that rely on accurate contact data may encounter questions about how their employees’ details entered an unprotected store. Because the owner remains unknown, no notification process or remediation timeline was established for those affected.

Were you affected?

Check whether your email address appears in public breach records by running a free exposure scan on a reputable lookup service. Review any unexpected sales or marketing messages for signs that your details are circulating in lists, and consider limiting the personal information you share on professional directories or registration forms.

AICompiled with AI assistance from public sources and published under our editorial standards.