[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbe35zblligw4":3},{"success":4,"breach":5},true,{"_id":6,"name":7,"title":8,"slug":9,"domain":10,"breachDate":11,"addedDate":12,"modifiedDate":12,"contentUpdatedAt":13,"source":14,"sourceUrl":15,"sourceUrls":16,"pwnCount":18,"affectedCount":18,"affectedCountStatus":19,"affectedCountLowerBound":20,"affectedCountUnit":21,"hasEnglishDescription":4,"severity":22,"dataClasses":23,"description":44,"seoTitle":45,"seoTitleEn":46,"seoDescription":45,"seoDescriptionEn":47,"logoUrl":48,"isVerified":4,"isSensitive":49,"isSpamList":49,"isMalware":49,"company":50},"68e3266eda11adda488251be","Exactis","Exactis Data Breach","exactis","exactis.com","2018-06-01T00:00:00.000Z","2018-07-25T20:00:44.000Z","2026-07-18T23:50:28.084Z","Verified breach record","https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fexactis-database-leak-340-million-records\u002F",[15,17],"https:\u002F\u002Fwww.consumerfinancialserviceslawmonitor.com\u002F2018\u002F07\u002Fexactis-data-leak-to-affect-millions-of-americans\u002F",131577763,"known",null,"unknown","Critical",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"Credit status information","Dates of birth","Education levels","Email addresses","Ethnicities","Family structure","Financial investments","Genders","Home ownership statuses","Income levels","IP addresses","Marital statuses","Names","Net worths","Occupations","Personal interests","Phone numbers","Physical addresses","Religions","Spoken languages","\u003Cp>The Exactis data breach came to light in 2018 when a large dataset belonging to Exactis, a company operating in marketing and data brokerage, was found publicly accessible on the internet. At the core of the incident, there was a risk very different from passwords or payment card information: contact, demographic, household, and interest data compiled from various sources had been merged into a single profile. Therefore, the Exactis leak should not be considered limited to just searching for email addresses; it should be examined through a broad profile picture, including who the person is, where they live, which income group they are evaluated in, which interests they are matched with, and which communication channels they can be targeted through.\u003C\u002Fp>\n\u003Cp>The verified record set contains 131,577,763 unique accounts. The incident date is considered June 1, 2018, and the date the record was added to reliable breach databases is considered July 25, 2018. Publicly available technical assessments indicate that the larger raw dataset could include records of hundreds of millions of individuals and businesses, whereas the number of verified accounts is determined based on the portion that can be matched with an email address. This distinction is important because the total number of rows is not the same as the number of unique accounts, and priority should be given to the number of unique accounts in the risk assessment presented to the user.\u003C\u002Fp>\n\u003Ch2>Leaking Data Types and Risks\u003C\u002Fh2>\n\u003Cp>Exactis records include directly identifiable fields such as email addresses, full names, phone numbers, physical addresses, IP addresses, and dates of birth. In addition, profile data such as credit status information, education level, ethnic background, family status, financial investment interests, gender, home ownership status, income level, marital status, net worth range, occupation, personal interests, religion, and languages spoken are also listed. This combination could allow attackers to generate personalized fraud, targeted messages, fake customer service calls, or phishing scenarios without needing a single password.\u003C\u002Fp>\n\u003Cp>The most critical aspect of this breach is that it combines pieces of data that may seem limited when viewed individually. An email address, phone number, and physical address make a person easily reachable; income, household, and interest information indicate which promises or pressure tactics might be more persuasive. Therefore, the Exactis exposure increases the risks of social engineering, targeted ad abuse, fraud, and profile-based discrimination more than the risk of account takeover.\u003C\u002Fp>\n\u003Ch2>Verified Scope and Boundaries\u003C\u002Fh2>\n\u003Cp>The verified scope should be considered as 131,577,763 unique accounts. This number is kept separate from the larger raw data claims and is the value used on the user control screen. The breach date is fixed as 2018-06-01, with addition and last modification dates fixed as 2018-07-25. The Exactis domain is retained as exactis.com, and the company's country is the United States, with its sector assessed as data brokerage and marketing data.\u003C\u002Fp>\n\u003Cp>For Exactis, fields such as passwords, payment cards, bank accounts, or social security numbers are not among the verified data classes. However, this does not make the risk low. When profile fields such as credit status, income, address, family, and beliefs are combined, it can make the person more vulnerable to security questions, targeted fraud flows, and fake institutional correspondence. Therefore, due to the risk level, number of records, and profile depth, it has been kept as Critical.\u003C\u002Fp>\n\u003Ch2>User Groups at Risk\u003C\u002Fh2>\n\u003Cp>The group most likely to be affected by this event are individuals included in consumer profiles or marketing lists based in the United States. Even if a person has never used Exactis, it is possible that their name, email address, or address has been compiled from third-party lists due to the data brokerage model. Therefore, the risk is not dependent on having an actual user account in the traditional sense.\u003C\u002Fp>\n\u003Cp>Users who frequently interact with sales, real estate, finance, health, education, or donation campaigns may become more visible targets. Similarly, individuals who have used the same phone number and email address for a long time may still have old profile fields used in fraud attempts. Data such as marital status, occupation, income, and interests can help an attacker make the message appear personal and convincing; this especially requires being more cautious with requests received via phone calls, text messages, and emails.\u003C\u002Fp>\n\u003Ch2>Urgent Measures to Be Taken\u003C\u002Fh2>\n\u003Cp>Since there is no data class with verified passwords in the Exactis record, the first action should not be limited to just changing the password. Users should primarily scrutinize unexpected requests sent to their email addresses, phones, and physical addresses more rigorously. For messages that come under the pretext of finance, cargo, government institutions, insurance, school, charity campaigns, or subscription renewals, verification through the official communication channel of the institution is required before clicking on any links.\u003C\u002Fp>\n\u003Cp>A strong and unique password should be used for the email account, and multi-factor authentication should be enabled wherever possible. For the phone operator account, an additional PIN or security password should be set up for SIM changes, number porting, and customer service transactions. Since address and phone information are included in Exactis data, information should not be shared directly in response to fake deliveries, debt notifications, investment offers, or survey calls; forms requesting date of birth, income, and family information should be evaluated with caution.\u003C\u002Fp>\n\u003Ch2>Long-Term Security Strategies\u003C\u002Fh2>\n\u003Cp>In cases of exposure to such data brokers, a long-term strategy should focus on making the personal profile harder to reuse rather than just repairing a single account. Users may prefer to use separate addresses for finance, shopping, social media, and newsletters instead of using the same email address for all services. If a service will only be used for a campaign or trial purpose, using a separate address instead of the permanent main email address reduces the risk of future matching.\u003C\u002Fp>\n\u003Cp>Credit reports and financial transactions should be reviewed at regular intervals, and services that provide notifications for new account openings or suspicious inquiries should be activated. Official forms requesting removal from data broker lists can be reviewed; however, it should be remembered that these processes do not always provide permanent results. The strongest defense is to avoid making hasty decisions in unexpected communications, not to enter personal profile information into unnecessary forms, and to use additional verification for high-value accounts.\u003C\u002Fp>\n\u003Ch2>Record Control and User Action\u003C\u002Fh2>\n\u003Cp>Users who appear in the Exactis results on LeakData should treat this record not as a password leak but as detailed profile exposure. The fact that email addresses, phone numbers, addresses, and demographic fields appear together can lead to easier attempts at convincing phishing messages, personalized calls, and security question guesses. Therefore, when a warning is seen, all important accounts using the same email and phone number should be reviewed, rather than just checking the relevant site.\u003C\u002Fp>\n\u003Cp>The most appropriate steps after the check are; strengthening the email account, enabling multi-factor authentication, adding an extra security code to the phone operator account, monitoring financial transactions, and avoiding unexpected connections. Official-looking letters sent to the physical address, verification codes requested over the phone, and surveys asking for personal details should also be examined. An Exactis record should be considered a high-impact breach, indicating that a person's digital and physical communication points can be targeted, even if authentication information has not been leaked.\u003C\u002Fp>","","Exactis Data Breach (131.6 Million Reported Records)","Exactis Data Breach. 131.6 Million reported records were reported. Reported data: Credit status information, Dates of birth, Education levels. Review the…","\u002Fuploads\u002Flogo\u002Fexactis_com.webp",false,{"name":7,"sector":51,"country":52,"website":10,"websiteArchiveUrl":45,"websiteStatus":45,"websiteCheckedAt":20},"Data broker \u002F Marketing data","United States"]