Breach Disclosure: People Data

Over 1.2 billion records of publicly available information scraped from social media sites have been leaked, due to an unsecured server. This information includes phone numbers and email addresses, along with work history, and was likely scraped from public social media profiles. Although all data leaked from this server was already public, the correlation of the information to a particular individual was significant in this breach. This could potentially allow atttackers to more easily impersonate their victims.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

In essence, this breach involves "profiles" of individuals that associate publicly available phone numbers, email addresses, and work history with known social media accounts. This aggregation of information could potentially allow attackers to more easily impersonate their victims, or even allow attackers to conduct identity theft more easily.

Although the number of records included in this breach is significant, it is important to note that all leaked information was already public. No payment information or passwords were included in this breach. The exact source of this information is unknown. Some of these records appear to have originated from People Data Labs, however, there is no indication that the company was actually breached. Rather, these records seem to be cobbled-together from a number of different sources.