1.5M Business Records From Factual Breach Still Circulating

HEROIC analysts identified the Factual breach while tracking older datasets that have recieved renewed attention on dark web trading forums. Around January 2017 or earlier, the marketing data analytics company Factual.com had its database compromised, exposing 1,559,153 records containing email addresses, phone numbers, and business homepage URLs. The data recently resurfaced in fresh agregation services, putting these business contacts back in play for attackers looking to run targeted campaigns.

Why Business Contact Data Is a Phishing Goldmine

When attackers get their hands on email addresses, phone numbers, and business URLs together, they can build very convincing scams. They know who to call, what company the person works for, and where to send a fake invoice or spoofed email. This combination is partcularly useful for crafting business email compromise attacks, where criminals impersonate vendors or executives to trick employees into wiring money or sharing login credentials.

What Was Exposed in the Factual Breach

• Email Address
• Phone Number
• HomePage URL

Why Business Data Breaches Have a Long Reach

Even though this breach is years old, business contact information stays useful for a long time. Email addresses and phone numbers at established companies change slowly. Attackers use this data to build target lists for phishing, robocalls, and social engineering schemes. The risk of credential stuffing is lower here since no passwords were exposed, but the real danger is beleived to be in the sophisticated fraud and impersonation campaigns this data enables.

How Database Breaches Work

A database breach happens when attackers gain unauthorised access to the database where a company stores its user or customer information. This can happen through weak passwords on database servers, unpatched software vulnerabilities, or misconfigured cloud storage that accidentally exposes data to the public internet. Once inside, attackers can copy millions of records in minutes. The stolen data is then sold or traded on dark web marketplaces.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to tell you if your email address or business information appeared in the Factual breach or thousands of others. Run a free scan at HEROIC.com to find out what attackers may already know about you.