Phishing Campaigns Likely After Excellanto Leaks 482,242 Emails

HEROIC DarkHive spotted a breach of Excellanto, an Indian IT services and consulting firm, on 29 November 2024. The database compromise exposed 482,242 unique email addresses that are now circulating among phishing operators and business email compromise crews.

Why This Email Only Breach Is Dangerous

A list of 482,242 addresses tied to a known IT consulting brand is a ready made phishing seed list. Attackers can craft emails that reference Excellanto invoicing, ticket numbers, or Microsoft 365 portal logins, and recipients who have previously interacted with the firm are far more likely to click.

What Was Exposed in Excellanto

The leaked dataset contains only email addresses, no passwords, no names, no phone numbers. That sounds limited, yet the domain clustering inside the list is itself a map of Excellanto clients, which is high value reconnaissance for targeted intrusions.

Why This Matters

IT services firms sit between dozens of client environments, so every compromised contact is a potential pivot. The SolarWinds event made it clear how a single supply chain foothold cascades, and an email list is often the first step in building that foothold.

How Database Breaches Happen

Database breaches at consulting firms frequently start with an exposed CRM backup, an abandoned staging site, or a phishing compromise of a sales account. Once an attacker accesses the mail list table, they export and post it to BreachForums in exchange for forum credits or private sale.

Check If You Are Affected

HEROIC monitors over 400 billion compromised records across the surface, deep, and dark web. Run a free scan to see whether your email appears in the Excellanto leak, then be skeptical of any unexpected invoice, support ticket, or login prompt claiming to come from the firm or its partners.