When Dun & Bradstreet bought NetProspex in 2015, it also acquired an enormous 52GB database containing just under 33.7 million unique corporate records. Now, that information has found its way out into the world for anyone to access.
The leaked database is normally used for marketers who are creating targeted campaigns for clients and prospects. Companies are able to buy portions of the records to suit their marketing needs, which is common practice. Unfortunately, while this type of information is valuable in honest attempts to grow a business, it’s also quite attractive to identity thieves and other criminals.
Dun & Bradstreet is insisting that their company’s systems were not breached and though they own the database, they’ve also sold the information to “thousands” of other firms. That means any of those companies could have suffered a breach, and they don’t even realize it yet.
What Kind of Information was Exposed?
The leaked information is from a corporate database, so it contains information for millions of U.S. employees and companies. ZDNET reports the database has dozens of different fields, including:
- Full names
- Job titles
- Work email addresses
- Phone numbers
- Believed office location
- Number of employees in business unit
- Company industry
Some of the information, like office location and industry, are things that are easily found in public records. Other things, however, like email addresses and phone numbers, are not.
Troy Hunt from Have I Been Pwned analyzed the records in the database and shared the top ten companies that had employee information exposed:
- S. Department of Defense CCE
- S. Postal Service
- AT&T, Inc.
- Wal-Mart Stores, Inc.
- CVS Health Corporation
- The Ohio State University
- Citigroup, Inc.
- Wells Fargo Bank, National Association
- Kaiser Foundation Hospitals
- International Business Machines Corporation
“Whilst you could piece together parts of the data from information already in the public domain, having it aggregated and so easily searchable in this fashion is enormously valuable,” said Hunt in an email to ZDNET. “It also serves as a reminder that we’ve lost control of our privacy; the vast majority of people in the data set would have no idea their information is being sold in this fashion and they certainly don’t have any control over it.”
With this type of corporate information out in the open, we have no doubt that many individuals on the list are going to be targeted more frequently by phishing emails. With access to emails, full names, and job titles, phishing scam artists can pinpoint high net worth individuals and try to lure them into elaborate schemes with the purpose of stealing their money and identities.
