Names, Birthdays: Iraq Independent High Electoral Commission Breach

A data breach dated January 1, 2019 exposed 24,907,441 records tied to the Iraq Independent High Electoral Commission, HEROIC analysts found. Each record lists a first name, a last name and a birthday. The only way to know whether your details are among them is to scan your email.

What a Name and a Birthday Can Unlock

A full name and a date of birth look harmless, yet together they answer the questions that identity checks start with. A caller who knows both can sound credible, and a form that asks for a birthday to confirm who you are can be answered correctly by someone else. That is the practical risk in this record.

Three Fields, No Passwords

• First names: used to address you directly in a scam message.
• Last names: with a first name, they pin the record to one person.
• Birthdays: a common identity check that cannot be changed after a leak.

No email addresses, phone numbers or passwords are listed, so nothing in the record opens a sign-in on its own.

Why Details You Cannot Change Still Matter

A password can be replaced after a leak. A birthday cannot. Attackers can match names and dates against other leaked data to fill in the gaps, which is how scattered details turn into a usable profile of one person. Each of the 24,907,441 records is a candidate for that kind of matching.

Where Breached Records Come From

A database breach means records were taken from one organization's own systems, not from the devices of the people listed. The copy can contain an entire table at once. Once it is out, the people in it have no way of knowing unless they check, so a lookup by email is the quickest route to an answer.

Is Your Name in This Breach?

To check, scan your email and see your information. Because the record holds names and birthdays, watch for scam emails, texts and calls that address you by name, and be careful with any message that asks you to confirm your birthday. Share a date of birth only with organizations you contacted yourself.

The scan covers a work email just as readily as a personal one.