Truth Finder Data Breach (2019): What Was Exposed & What To Do

What happened

The breach occurred in 2019 and affected 8.2 million unique customer records. The data later disclosed included email addresses, names, phone numbers, and passwords stored as scrypt hashes. Public reporting of the incident is dated April 12, 2019, though the dataset itself surfaced publicly only in early 2023. No further details on the method of access, duration of exposure, or subsequent actions by the organization have been released in available records.

How a breach like this happens

Incidents involving large customer datasets at online services commonly result from unauthorized access to inadequately protected databases or application servers. Attackers may exploit vulnerabilities in web applications, misconfigured cloud storage, or stolen administrative credentials to extract records in bulk. Once obtained, the data can remain undetected until it appears on public forums or is offered for sale. Passwords stored only as hashes, even with a memory-hard algorithm such as scrypt, still require additional protective measures like salting and rate-limited authentication to limit offline cracking attempts.

Truth Finder and its sector

TruthFinder operates as a public-records search platform that aggregates and provides access to personal information drawn from various sources. Services in this sector routinely collect and retain customer contact details, account credentials, and identifiers to facilitate searches and account management. A breach at such a company is consequential because the records often contain direct contact information that can be used for further targeting, and because the same customers may reuse credentials across other sites.

What was likely exposed

The disclosed dataset contained email addresses, names, phone numbers, and passwords stored as scrypt hashes for 8.2 million customers. Organizations of this type typically hold additional fields such as billing information, search histories, or linked public records, but the exact scope of the TruthFinder incident beyond the four named categories remains unconfirmed in public reporting.

What's at stake

Exposed email addresses and phone numbers can be used for targeted phishing or unsolicited contact. Hashed passwords, while not immediately readable, may be subjected to offline attacks if the hashing parameters prove insufficient against current hardware. For the organization, the incident highlights the long-term retention and eventual disclosure risks associated with large volumes of customer authentication data. Affected individuals face the practical burden of monitoring accounts and updating credentials where reuse is suspected.

What to do if you're exposed

Individuals who believe their information may have been included should change passwords on TruthFinder and any other accounts that share the same credentials. Enabling multi-factor authentication where available adds a further control. Monitoring email and phone accounts for unusual activity provides an early indicator of misuse. Readers can run a free exposure scan of their email address against known breach data to determine whether their details appear in this or other documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.