Someone Could Be Using Your Leaked CFGI Contact Details

Picture someone quietly working through a spreadsheet of names, phone numbers, and emails, calling one after another while pretending to represent CFGI. HEROIC analysts found a data breach dated March 2026 that exposed 249,348 records taken directly from the firm's own stored data, including email addresses, usernames, first and last names, and phone numbers. No passwords were involved, but scanning your email is still the clearest way to know if you're one of the people in that spreadsheet.

Why This Is Dangerous

A real name, username, and working phone number are enough to make an impersonation attempt sound legitimate, especially when the caller references a company you actually work with. Business contact data like this tends to attract targeted phishing rather than random spam, since the person on the other end already knows who you are and where you fit. That context is what makes a scam call or email harder to spot.

What Was Exposed

• Email Address
• Username
• First Name
• Last Name
• Phone Number

In practice, data like this fuels business email compromise attempts, where a message appears to come from a known contact and asks for a payment, a password reset, or sensitive information. A phone number paired with a real name also opens the door to vishing calls that sound far more credible than a cold outreach. Left unaddressed, this kind of exposure can lead to real financial loss for the people or firms targeted.

A breach like this happens when records are pulled from wherever a business stores its contact and account data, rather than gathered from individual devices or assembled from scattered public lists. The point of failure sits with the systems holding that data, not with any single person's own habits. Once removed, information like this tends to keep circulating well beyond the firm's control.

Check If Your Details Were Included

Scan your email to see if it shows up in this exposure.

• Treat unexpected calls or emails referencing CFGI with caution, especially requests for payment or sensitive information.
• Verify any unusual request through a separate, known contact method before acting on it.

This matters whether the exposed email is personal or one you use for work.