Straffic Data Breach (2020): What Was Exposed & What To Do

In February 2020, a publicly accessible database belonging to the Israeli marketing company Straffic was found to contain personal information on tens of millions of individuals. The exposure involved 140 GB of data stored in an Elasticsearch instance that required no authentication to view. Reports at the time indicated that more than 300 million rows were present, including 49 million unique email addresses along with names, phone numbers, physical addresses and genders. For the people whose records appeared in the dataset, the incident raised questions about how their contact details had been collected and why they were left unprotected.

What happened

The incident came to light on 14 February 2020. Researchers identified an Elasticsearch database that had been left open to the internet, allowing anyone to retrieve its contents without a password or other controls. The dataset held approximately 140 GB of records and contained over 300 million rows. Within those rows were 49 million distinct email addresses together with associated names, phone numbers, physical addresses and gender information. Straffic later acknowledged the exposure in a statement that noted it is impossible to create a totally immune system and that such events can occur. No further technical details about the duration of the exposure or the method of discovery were released by the company.

How a breach like this happens

Incidents involving Elasticsearch and similar search databases often stem from default configurations that leave the service reachable from any internet address. When authentication is not enabled or access rules are not applied, the entire index becomes readable by automated scans that constantly search for open ports. Marketing and analytics platforms frequently maintain large indexes to support fast lookups across customer records, increasing the volume of data that can be reached if the instance is misconfigured. Once discovered, the contents can be downloaded in full without triggering conventional intrusion alerts because no login attempt is required.

About Straffic

Straffic is an Israeli company that operates in the marketing and data-services sector. Organisations of this type routinely compile large contact lists to support advertising campaigns, audience segmentation and lead generation. The datasets they maintain commonly include names, email addresses, telephone numbers and postal details so that messages can be delivered across multiple channels. When records on this scale are exposed, the information can be reused for unsolicited contact or combined with other sources to build more detailed profiles of individuals.

The information in question

The exposed records included email addresses, names, phone numbers, physical addresses and genders. The presence of 49 million unique email addresses within more than 300 million rows indicates that many entries were repeated or linked to additional attributes. No other categories of data, such as financial details or government identifiers, were reported as part of the dataset. The exact scope of collection sources and the length of time the database remained accessible remain unconfirmed beyond the initial public reports.

The real-world impact

Individuals whose information appeared in the dataset may receive increased volumes of unsolicited email and telephone calls. The combination of name, address and phone number can also be used to verify or expand records held by other parties, potentially affecting future interactions with services that rely on these details for identity checks. For Straffic, the incident highlighted the operational risks that accompany storage of large-scale marketing data, including possible regulatory scrutiny and loss of trust from clients who supplied the original contact lists.

If your data was in this breach

Review any recent unsolicited messages for patterns that match the exposed fields and consider using a secondary email address for marketing-related sign-ups. Enable available privacy controls on accounts that may have been created with the same contact details. Readers can run a free exposure scan of their email address against known breach data to determine whether their information appears in public listings of this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.