Flash Report: Web Page Shares Personally Identifiable Information of CEOs

Key Findings

• A person or group with an affinity for the suspect alleged to have murdered a United Health Care CEO promoted an online database containing personally identifiable information (PII) on at least 1,061 corporate executives.
• Although the site has been taken offline as of this writing, an archived version remains, which could still enable a motivated, internet-literate person or group to gain access to an executive's PII.
• The database consolidates already publicly available contact information in one place—including executive names, job titles, company affiliations, LinkedIn profiles, and in many cases, mobile phone numbers—raising concerns about its potential misuse for harassment or targeted intimidation.

Details

On May 29, 2025, ZeroFox observed the web page theceodatabase[.]com, which hosts a publicly accessible database of PII associated with over 1,000 corporate executives. The domain appears to be a copy of another web page, luigiwasright[.]com, which was registered in April 2025. Both domains return a 502 error at the time of writing, but much of the information can be observed via a web archive capture.

The PII database features the following fields:

• Company Name
• Job Title
• First Name
• Last Name
• Email (address)
• Mobile (number)
• Office (number)
• Personal Linkedin URL
• Website
• Department
• Company Valuation
• Seniority

While all fields within the database are populated, ZeroFox has not verified the authenticity and accuracy of the information as of this writing. The origin of the information is unclear, though the majority of fields are almost certainly drawn from publicly available sources, such as social media platforms, business directories, news outlets, or stock market indexes—much of which could be compiled using easily-accessible scraping tools. However, the origin of the phone numbers is unclear, with a roughly even chance that the data was compiled from one or more data breaches.

• The vast majority of listed organizations and executives are located within the United States, though entities registered within Europe and Asia were also present. 

• ZeroFox observed no correlation between organization size, annual revenue, or industry. 

The domain luigiwasright[.]com is almost certainly a reference to Luigi Mangione, the individual arrested for the murder of a UnitedHealthcare CEO on December 4, 2024. This choice of domain name alludes to the likely antagonistic nature of the database, suggesting its intent is to encourage or facilitate hostile action against CEOs. This is compounded by a statement noted within the web page about the site being intended to “empower ordinary citizens” to directly contact “decision makers.”

ZeroFox has not observed any significant promotion or deep and dark (DDW) chatter surrounding the database as of this writing, though a PayPal “donate” section within the web page links to an entity named “No App Bans LLC”. This PayPal page is not currently accessible, though ZeroFox notes it is associated with an individual located in the United States that has previously promoted luigiwasright[.]com on the Facebook platform.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 15:00 PM (EDT) on May 30, 2025; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Appendix: ZeroFox Intelligence Probability Scale 

All ZeroFox intelligence products leverage probabilistic assessment language in analytic judgments. Qualitative statements used in these judgments refer to associated probability ranges, which state the likelihood of occurrence of an event or development. Ranges are used to avoid a false impression of accuracy. This scale is a standard that aligns with how readers should interpret such terms.