Identity Theft Just Got Easier Because of the Click.org Breach: 564K People at Risk

HEROIC analysts found a database breach linked to Click.org, a click tracking and advertising platform based in Iceland. The breach, dated April 16, 2021, exposed 564,379 records. The leaked data includes email addresses, phone numbers, usernames, first names, and last names. The dataset was later found circulating on breach forums, where it recieved attention for the completeness of its personally identifiable information.

How Exposed Names and Phone Numbers Enable Targeted Phishing

When full names, email addresses, and phone numbers are combined in a single dataset, attackers can craft highly personalized phishing messages and SMS scams. Unlike generic spam, these targeted attacks use real personal details to beleive they are coming from a trusted source. Victims are far more likely to click malicious links or hand over additional credentials when messages address them by name and reference accurate contact information.

What Was Exposed in the Click.org Breach

• Email Address
• Phone Number
• Username
• First Name
• Last Name

Why the Click.org Breach Creates Lasting Identity Risk

Personally identifiable information does not expire. Names, email addresses, and phone numbers exposed in 2021 remain valid and useful to attackers today. This data is partcularly valuable for identity theft operations where criminals piece together profiles from multiple breaches. Combined with data from other leaks, the Click.org records can help fraudsters open accounts, take over existing ones, or commit financial fraud in victims' names.

How Database Breaches Work

A database breach occured when an attacker exploits a vulnerability in a web application or server to extract records stored in a backend database. Common attack methods include SQL injection and exploitation of misconfigured cloud storage. Once the data is extracted, it is typically sold on dark web forums or traded among threat actor communities, where it is used for follow-on attacks including phishing, credential stuffing, and social engineering.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against more than 400 billion records across thousands of known breaches. If your information appeared in the Click.org breach or any other leak, you can find out right now and take action before attackers do.