Instant Checkmate Data Breach (2019): What Was Exposed & What To Do

Inside the incident

The breach involved records from Instant Checkmate’s customer database. Public reporting at the time and subsequent disclosures identified 11.9 million unique email addresses along with associated names, phone numbers, and passwords hashed using the scrypt algorithm. No further technical details about the intrusion method, duration, or exact date of access have been released by the company or confirmed through independent investigation.

How a breach like this happens

Incidents affecting customer databases at online services often begin with the exploitation of remote access points, unpatched software, or compromised credentials that allow unauthorised entry into internal systems. Once inside, attackers can locate and copy tables containing user records. In many cases the data are later posted or sold on forums and leak sites. The presence of hashed passwords indicates an attempt to store credentials in a non-plaintext form, though the security of any hash depends on additional factors such as salting and computational cost that are not disclosed here.

About Instant Checkmate

Instant Checkmate operates in the people-search and background-report sector, providing users with aggregated public records on individuals. Companies in this field routinely collect and store contact details, identifiers, and authentication data to deliver their services. A breach at such an organisation is consequential because the records it holds are, by design, tied to real-world identities and contact information that can be cross-referenced with other available sources.

What data was at risk

The disclosed records included the following categories:

• Email addresses
• Names
• Phone numbers
• Passwords stored as scrypt hashes

Exact additional fields, if any, remain unconfirmed in public reporting.

What's at stake

For individuals, exposure of names, email addresses, and phone numbers can increase the volume of unsolicited contact and the material available for targeted phishing or social-engineering attempts. Hashed passwords may be subject to offline cracking attempts, particularly if users reused those credentials elsewhere. For the organisation, the incident adds to the body of known exposures in the people-search industry and may prompt regulatory scrutiny or customer inquiries, though specific legal or financial outcomes have not been detailed in available reports.

Were you affected?

Individuals can check whether their email address appears in known breach datasets by using a free exposure scan offered by reputable breach-monitoring services. If matches are found, standard steps include changing passwords on the affected account and any other sites where the same password was used, enabling multi-factor authentication, and monitoring email and phone accounts for unusual activity. Organisations holding similar data are advised to review access controls and hashing practices even when specific incident details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.