The X Factor Data Breach

The leaked audition registration table (raw.sql and xfactor-database.txt) contains applicant profiles submitted for Season 1 of the US television series The X Factor. The incident compromised records for 66,576 unique contestants, exposing:

• Personal & Identity Details: Full legal names (firstname, lastname) and reported gender.
• Contact Credentials: Canonical email addresses and direct telephone numbers.
• Demographic Information: Dates of birth (dob).
• Geographic Location: Postal ZIP codes and registered audition cities (Los Angeles, Chicago, Seattle, etc.).
• Audition Metadata: Performer type (solo/group) and registration timestamps.

Rigorous RFC canonical parsing and deduplication confirmed 66,576 unique valid email addresses.

LulzSec exploited vulnerabilities in Fox's web-facing audition registration portal (database server 10.96.57.102) to extract the MySQL table without administrative privilege. The public dump of contestants' direct telephone numbers, dates of birth, and emails led to targeted harassment, unsolicited calls, and social engineering risks.

Individuals who registered for The X Factor auditions in 2011 should:

• Remain watchful regarding phishing emails or phone solicitations exploiting their audition history.
• Verify the legitimacy of any unexpected outreach claiming affiliation with talent agencies or broadcasters.