Cybersecurity Sector Breach: Alleged SOCRadar Dump Exposed 282 Million Emails

HEROIC analysts tracked a significant data release on August 3, 2024, in which a threat actor posted a dataset on a prominent hacking forum and claimed it was scraped from SOCRadar, a cybersecurity threat intelligence firm. The dataset contained 282,975,846 unique email addresses. Following investigation, SOCRadar determined that no unauthorized access to its internal systems occurred. The actor had instead exploited publicly available data aggregation features on the SOCRadar platform to construct the large email dataset, rather than exfiltrating it through a traditional breach. Despite the absence of an internal compromise, the scale of the release makes it a meaningful exposure event for the individuals whose email addresses are included.

Why This Is Dangerous: Nearly 283 million email addresses in a single release create an enormous phishing surface. Even without passwords, threat actors can use validated email lists to launch large-scale phishing campaigns, sell the list to spam and fraud operations, or use it to probe other breach databases for matching credentials. The fact that the data originated from a cybersecurity firm's platform means the list likely skews toward security professionals and corporate users -- high-value targets for spear-phishing and business email compromise attacks.

What Was Exposed

• Email Address

Why This Matters

Email addresses are the primary identifier for online accounts and the most common delivery vector for phishing. With 282 million addresses compiled into a single validated list, attackers can automate targeted phishing at massive scale, test addresses against known credential databases for matches, and build profiles that combine this data with other leaked information. Organizations whose employee emails appear in this dataset face elevated risk of business email compromise and credential stuffing against corporate systems.

How Data Aggregation Abuse Works

Not all large-scale data exposures result from traditional hacking. Platforms that offer public-facing data lookup or aggregation services can be systematically queried by automated tools to harvest records at scale. When a service makes data searchable or downloadable without sufficient rate limiting or access controls, a determined actor can iterate through large input sets -- such as name lists or domain directories -- and compile the responses into a comprehensive dataset. This is distinct from a database breach but produces a similarly exploitable result: a large, structured dataset of personal information available to malicious actors.

Check If You Are Affected

With nearly 283 million email addresses in this release, the chances of exposure are significant. Use the HEROIC free identity scanner to check whether your email address appears in this dataset or any of the 400 billion+ records in our database. Even if no password was exposed here, knowing your email is on active threat actor lists lets you harden your defenses before an attack arrives.