ClearVoice Surveys

We've been tracking a concerning trend of older data breaches resurfacing in new contexts, often repackaged and redistributed for malicious purposes. What really struck us with this particular incident wasn't the initial breach itself, which occurred in 2015, but the fact that a 2015 database backup from ClearVoice Surveys, a market research company, was publicly available and then exfiltrated in April 2021. The setup here felt different because it highlights the long tail risk associated with improperly secured data backups, even years after the initial incident.

ClearVoice Surveys: 15 Million Records Resurface from 2015 Database Leak

In April 2021, a database backup from ClearVoice Surveys dating back to 2015 was taken from a publicly accessible location and subsequently shared on a popular hacking forum. What caught our attention was the age of the data combined with the sensitivity of the information exposed. While the initial breach occurred years prior, the re-emergence of this data underscores the persistent risk associated with legacy data stores and inadequate security practices.

The breach matters to enterprises now because it demonstrates how seemingly "old" data can be weaponized years later, potentially fueling credential stuffing attacks, phishing campaigns, and identity theft. It also highlights the critical need for robust data retention and disposal policies, as well as continuous monitoring for exposed backups, regardless of their age. This incident ties into broader threat themes like the exploitation of legacy systems, the importance of proactive threat hunting, and the ongoing risk of unsecured cloud storage.

• Total records exposed: 15,000,495
• Types of data included: Email Addresses, Phone Numbers, Plaintext Passwords, First Names, Last Names, Birthdays, Genders
• Sensitive content types: PII (Personally Identifiable Information)
• Source structure: Database Backup (details not publicly available, but likely SQL or similar format)
• Leak location(s): Popular hacking forum (specific URL unavailable due to forum policies, but widely reported)
• Date of first appearance: April 2021

External Context & Supporting Evidence

While specific details about the initial breach in 2015 are limited, the re-emergence of the data in 2021 was widely reported across the security landscape. For example, the incident was covered by BleepingComputer, which detailed the types of data exposed and the potential risks to affected individuals. Additionally, discussions on various security forums and Reddit communities highlighted the concern surrounding the use of plaintext passwords and the long-term implications of the breach. The fact that the data was initially exposed due to a publicly accessible backup aligns with a broader trend of misconfigured cloud storage and inadequate data protection practices.