Inside the Staminus Database Leak: 5,010 Contacts Exposed

HEROIC's threat intelligence team has catalogued a breach tied to Staminus, a former DDoS protection provider based in the United States, stemming from an incident dated March 11, 2016. The dataset contains 5,010 records, including email addresses, phone numbers, first names, and last names. No passwords were included in this dataset.

Why the Staminus Contact Leak Is Dangerous

Without passwords in the mix, the risk here comes from what a full contact profile enables: a name, email address, and phone number together are enough to run a convincing phishing email or a targeted phone-based social engineering attempt, sometimes called vishing. Because Staminus was a security company, an attacker impersonating it could exploit that trust to trick former customers into clicking a malicious link or sharing credentials for another system.

What Was Exposed in the Staminus Breach

• Email addresses
• Phone numbers
• First names
• Last names
• 5,010 total records

Why This Matters

Contact information alone does not lead directly to account takeover, but it is the raw material for phishing and impersonation attacks. Combined with data from other breaches, an attacker can build a detailed profile of a person and use it to make a scam message far more convincing, whether that message pretends to be a security alert, a billing notice, or a personal message referencing accurate details about the target.

How Database Leaks Like This Happen

This incident is classified as a database breach, meaning attackers gained direct access to Staminus's backend systems and extracted customer contact records in bulk. Staminus ceased operations following this and related incidents, but the exported data did not disappear with the company. It has continued to circulate on forums and messaging channels, sometimes bundled alongside more recent breaches to increase its perceived value to buyers.

Check If You Are Affected

If you were ever a Staminus customer, or want to check whether your contact information appears in any known breach, HEROIC's free breach scanner checks your email against more than 400 billion breached records, including this Staminus dataset, so you can see your exposure in seconds.