What You Need to Know:
When Dun & Bradstreet bought NetProspex, it also acquired an enormous 52GB database containing just under 33.7 million unique corporate records. That information has since found its way out into the world for anyone to access.
The leaked database is normally used by marketers who are creating targeted campaigns for clients and prospects. Companies can buy portions of the records to suit their marketing needs, which is common practice. Unfortunately, while this type of information is valuable in honest attempts to grow a business, it’s also quite attractive to identity thieves and other criminals.
Dun & Bradstreet insists that their company’s systems were not breached and though they own the database, they’ve also sold the information to “thousands” of other firms. That means any of those companies could have suffered a breach and might not even realize it.
What Kind of Information was Exposed?
The leaked personally identifiable information (PII) was from a corporate database, it contained information for millions of U.S. employees and companies, including:
- Full names
- Job titles
- Work email addresses
- Phone numbers
- Believed office location
- Number of employees in a business unit
- Company industry
Troy Hunt from Have I Been Pwned analyzed the records in the database and shared the top 10 companies that had employee information exposed:
- U.S. Department of Defense CCE
- U. S. Postal Service
- AT&T, Inc.
- Wal-Mart Stores, Inc.
- CVS Health Corporation
- The Ohio State University
- Citigroup, Inc.
- Wells Fargo Bank, National Association
- Kaiser Foundation Hospitals
- International Business Machines Corporation
“With this type of corporate information out in the open, individuals whose personal information was exposed can be targeted more frequently by phishing emails. With access to emails, full names, and job titles, phishing scam artists can pinpoint high net worth individuals and try to lure them into elaborate schemes with the purpose of stealing their money and identities.
