Intelimost Data Breach (2019): What Was Exposed & What To Do

In an era where spam campaigns frequently exploit exposed credentials to impersonate known contacts, incidents involving large-scale email and password exposures remain a persistent feature of the threat landscape. The Intelimost case, reported on March 10, 2019, illustrates how operational databases supporting such activity can themselves become publicly accessible. Security researcher Bob Diachenko identified an exposed Elasticsearch database containing over 3 million unique email addresses along with associated plain-text passwords. These credentials were tied to a spam operation known as Intelimost that had sent millions of messages appearing to originate from recipients’ known contacts. The passwords in the dataset were described as those used to access victims’ mailboxes and to customise the spam content.

What happened

The incident came to light in March 2019 when the exposed database was discovered. Public reporting at the time stated that 3.1 million people were affected. The only data types explicitly named in available reports are email addresses and passwords stored in plain text. No further details on the duration of exposure, the precise method of initial access, or the total volume of records have been disclosed.

How a breach like this happens

Exposures of this type commonly result from misconfigured database instances left reachable from the public internet. Elasticsearch clusters, when deployed without authentication or network restrictions, can be indexed by search engines and subsequently located by researchers or malicious actors. Once discovered, the contents become available without any additional compromise of the underlying systems.

Who is Intelimost?

Intelimost operated as a spam-sending service that leveraged compromised email accounts to generate messages that appeared to come from people known to the recipients. Organisations engaged in bulk email activity routinely maintain databases of addresses and credentials to manage campaigns. A breach at such an operation is consequential because the data directly supports impersonation techniques that reduce the likelihood of messages being filtered as unsolicited.

What was likely exposed

The only data types confirmed in public reports are email addresses and passwords. Organisations that run email-based operations typically store additional operational metadata such as account settings, contact lists, or campaign logs, yet the exact scope of records in this instance remains unconfirmed beyond the two categories named.

Why it matters

Plain-text passwords paired with email addresses allow straightforward reuse against other services where the same credentials may have been employed. Recipients of the spam may also face secondary risks if their mailboxes were accessed to harvest further contacts or to maintain the operation. For the organisation, the exposure removes the operational secrecy that such services depend upon.

What to do if you're exposed

Individuals can begin by changing passwords on any accounts that share the exposed credentials, prioritising email and any linked financial or identity services. Enabling multi-factor authentication where available adds a layer that prevents simple password reuse. Readers may also run a free exposure scan of their email address against known breach datasets to determine whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.