Lead Hunter Data Breach (2020): What Was Exposed & What To Do

In March 2020, a large collection of personal records linked to Lead Hunter was discovered on a publicly accessible server and later supplied to Have I Been Pwned. The incident involved 68.7 million affected individuals and included email addresses along with names, phone numbers, genders, physical addresses and IP addresses. At the time of reporting, the party responsible for obtaining and exposing the data remained unidentified. Such incidents form part of a broader pattern in which organisations that store large volumes of contact and marketing data become sources of unintended disclosure when basic security controls are absent.

What happened

The records were found exposed on a publicly facing Elasticsearch server and were referred to as the Lead Hunter dataset. They contained 69 million unique email addresses across 110 million rows, together with the additional fields already noted. The material was provided to Have I Been Pwned by dehashed.com and was reported on 4 March 2020. No attribution has been established for the exposure.

How a breach like this happens

Exposures of this kind commonly result from the deployment of database or search services without authentication or network restrictions. When such systems are reachable from the public internet, any party that locates the open port can retrieve the contents in full. The absence of access controls means the data requires no additional compromise of credentials or applications; discovery alone is sufficient for extraction.

About Lead Hunter

Lead Hunter operated in the lead-generation and data-supply sector, collecting and maintaining contact information used for marketing and sales outreach. Organisations in this field routinely hold large volumes of names, addresses, telephone numbers and email addresses, often supplemented by demographic details and network identifiers. A dataset of this scale therefore represents a concentrated repository of information that individuals have typically supplied in commercial contexts rather than through direct interaction with the service.

What was likely exposed

The published record lists email addresses, names, phone numbers, genders, physical addresses and IP addresses as present in the material. The exact scope of every field across all rows has not been independently verified beyond the summary provided at the time of disclosure. Organisations that maintain marketing and lead data commonly store these categories of information; the precise contents of this particular collection remain those reported in the March 2020 notification.

The real-world impact

Individuals whose records appeared in the dataset face an increased likelihood that their contact details will be used for unsolicited communications or incorporated into further lists circulated among data brokers. Phone numbers and physical addresses can support targeted social-engineering attempts, while email addresses enable phishing campaigns that reference known personal details to appear more credible. For the organisation, the exposure removes control over a commercial asset and may affect relationships with clients who supplied or purchased the data.

Were you affected?

Anyone who wishes to check whether their email address appears in this or other documented incidents can submit it to a public breach-checking service for a free scan against known data. Where exposure is confirmed, standard protective steps include monitoring for unusual account activity, using unique passwords with a password manager, and enabling multi-factor authentication on important services.

AICompiled with AI assistance from public sources and published under our editorial standards.