If You Run a Business on ClickFunnels, This 55,462-Record Breach Should Worry You

HEROIC analysts discovered a database breach affecting ClickFunnels, a widely used US-based platform that helps businesses and entrepreneurs build sales funnels, landing pages, and automated marketing workflows. The dataset appeared on dark web forums on April 29, 2025 and contained 55,462 records. Each record held an email address, phone number, and the homepage URL of the website associated with the account. This last detail is unusual and particularly useful to attackers, because it tells them exactly what kind of business their target runs.

Why the ClickFunnels Breach Is Useful to Scammers

Most phishing attempts fail because they feel generic. The ClickFunnels breach changes that equation. With a target's email, phone number, and business website all in one record, an attacker can craft a message that references the victim's actual company, mimics the style of a legitimate vendor contact, and lands in an inbox that is already accustomed to receiving marketing and sales-related communications. This is exactly the kind of data used in business email compromise scams, where atttackers impersonate suppliers or payment processors to trick business owners into sending money or credentials.

What Was Exposed in the ClickFunnels Breach

• Email Addresses
• Phone Numbers
• HomePage URLs

Why This Matters If You Use ClickFunnels

If your email and business URL are in this dataset, you are a named target for business-focused phishing, unsolicited sales spam, and potential credential stuffing if you reuse passwords across accounts. Attackers may also use your homepage URL to research your business, identify your payment processor, and impersonate that processor in follow-up scams. Even without passwords in this breach, the combination of contact and business data is enough to fuel highly convincing fraud. The risk of account takeover increases further if your phone number is used as a two-factor authentication method and falls into the hands of someone willing to attempt SIM swapping.

How Database Breaches Expose Platform User Data

A database breach occurs when unauthorized individuals gain access to the structured data stored by a company. For a platform like ClickFunnels, this data typically includes user account information collected during signup and account management. Breaches of this type often occur through SQL injection attacks, unprotected API endpoints, misconfigured cloud storage buckets, or compromised internal credentials. The extracted data is then compressed and sold or freely shared on dark web marketplaces. Because marketing platforms store contact details for both the platform users and their customers, a single breach can expose multiple tiers of people simultaniously.

Check If Your ClickFunnels Account Was Exposed

HEROIC's free breach scanner searches more than 400 billion compromised records to check if your email address appears in the ClickFunnels dataset or any other known breach. If your information is found, you will receive an immediate alert with details on what was exposed. The scan is free and takes under a minute. If you are a ClickFunnels user, changing your account password and reviewing any connected payment or billing integrations is a sensble precaution even if you are not yet confirmed as affected.