Factual Data Breach (2017): What Was Exposed & What To Do

In March 2017, a file containing 8 million rows of data was reported to have been compiled and later exchanged on the premise that it originated from Factual. The file included 2.5 million unique email addresses together with business names, addresses and phone numbers. Factual stated after consultation that the material consisted of publicly available information about businesses and other points of interest that the company already makes accessible on its website and to customers. The incident was reported on 22 March 2017. No further technical details on how the file was obtained have been released.

Breaking down the breach

The reported file was described as containing 8 million rows and 2.5 million distinct email addresses, along with employer names, physical addresses and telephone numbers. The material was presented by those circulating it as having come from Factual. Public statements from the company indicated that the records matched information already offered through its normal services rather than internal systems that had been accessed without authorisation. No confirmation of the exact method of collection, the date range of the records, or any additional data fields has been provided.

How a breach like this happens

Data aggregators routinely collect and redistribute large volumes of business and location information from public sources, commercial feeds and web scraping. Files of this kind can surface when an automated collection process is copied without permission, when access credentials are misused, or when a dataset intended for limited distribution is shared more widely. In some cases the same records remain available through legitimate channels, which can make it difficult to determine whether any unauthorised access occurred.

Factual and its sector

Factual operates as a commercial data provider that supplies structured information on businesses and points of interest to other organisations. Companies in this sector compile contact details, addresses and identifiers to support marketing, mapping and analytics services. A large-scale release of such records can affect the privacy of individuals whose business contact information appears in the dataset, even when the underlying facts are drawn from public directories.

What was likely exposed

The file was reported to contain email addresses, employer names, physical addresses and telephone numbers linked to 2.5 million unique individuals. Factual has stated that these categories of information are already published on its website and supplied to paying customers. No independent verification of additional fields or of any non-public data has been made available, so the precise contents of the circulated file remain unconfirmed beyond the categories named in the reports.

Why it matters

Business contact details can be used to construct targeted email or telephone campaigns. When large numbers of such records are assembled in one place, the risk of misuse for unsolicited contact or for combining the data with other sources increases. For the organisation, circulation of its datasets outside normal licensing channels can affect customer trust and contractual relationships even when the information itself is already public.

If your data was in this breach

Review any business email accounts associated with the listed addresses for unusual login attempts or increased spam. Consider using separate contact details for public business listings where possible. Readers can run a free exposure scan of their email address against known breach datasets to check whether their information appears in this or other reported incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.