Breach Disclosure: Leadhunter

An insecure Elasticsearch cluster has exposed the email and physical addresses, names, phone numbers, and genders of 69 million individuals. The exact source of this information is unclear, however, each row of data contains a reference to “leadhunter.” Although there is a German marketing company with this name, the organization has been confirmed as not being the source of the leaked data.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Similar to another recent breach of unknown origin, popular credential compromise website Dehashed was given the leadhunter data in March 2020. The data is over 110 million rows long, and appears to be aggregated from a variety of sources. Despite the mention of “leadhunter” appearing so frequently, this exposed data has not been attributed to any company associated with the term, and the origin is still unclear.

Figure 1: Sample of data contained in the breach