How DataGardener’s Database Breach Exposed 1.3M UK Business Records

HEROIC analysts found 1,383,841 records circulating from DataGardener, a UK-based business intelligence platform, after a database breach that occurred on July 1, 2024. The exposed records contain email addresses, first names, and last names belonging to users of a platform that provides detailed analytics on over 16 million UK companies. Because DataGardener aggregates and surfaces corporate data at scale, its user base skews toward business professionals, making every exposed record a potential entry point for targeted commercial fraud and executive impersonation.

Why This Is Dangerous

DataGardener's core product is business intelligence — detailed profiles of UK companies and the people connected to them. A breach of its user database does not just expose email addresses; it exposes the identity of professionals who have paid to access sensitive corporate data. Attackers who combine the leaked names and email addresses with DataGardener's own public-facing company data can construct highly convincing spear-phishing messages, impersonate executives, and target businesses represented in the platform's database. The overlap between a business intelligence user base and high-value corporate targets is direct and exploitable.

What Was Exposed

• Email Address
• First Name
• Last Name

Why This Matters

Full names paired with email addresses are the minimum dataset required to launch effective spear-phishing and business email compromise (BEC) campaigns. Attackers use this combination to craft messages that appear to come from known colleagues, vendors, or executives. Because no passwords were included, users may underestimate the risk — but identity-based fraud and account takeover via password reset flows require nothing more than a verified email and a name. Fraudsters also cross-reference leaked name-and-email pairs against other breach datasets to build richer profiles used in identity theft and financial fraud schemes.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a backend data store — typically through SQL injection, compromised administrative credentials, misconfigured access controls, or an exposed API endpoint. Once inside, the attacker can export entire tables of user records in minutes. The exfiltrated data is then packaged and sold or distributed through dark web forums and private Telegram channels. Because database breaches often go undetected for weeks or months, affected users have little warning before their information reaches criminal markets.

Check If You Are Affected

HEROIC's free breach scanner searches across more than 400 billion compromised records to tell you instantly whether your email address appears in known breach data, including incidents like this one. Run a free scan at heroic.com to find out if your information was exposed and take immediate steps to protect your accounts.