KnownCircle 2016 Data Breach

The external breach record uses April 12, 2016 and describes an outside party obtaining a large volume of data from the now-defunct service in approximately April 2016. It says the JSON-formatted dataset contained gigabytes of marketing data related to the real-estate and insurance sectors, including logs of emails sent and gift-card tracking. The original access method, exact access day, publication time, and company response are not disclosed.

The structured classes are email addresses, email messages, genders, names, passwords, phone numbers, and physical addresses. The list does not mean every field occurred together for every person. Payment cards, bank accounts, government identification numbers, and Social Security numbers are not classes in the external record.

The external source ties the password field to bcrypt hashes for a small number of KnownCircle staff, not to the full customer population. The entry is therefore not interpreted as a general customer-password leak or a plaintext-password event. The bcrypt statement also does not by itself prove that passwords could not be recovered; it identifies only the reported storage representation.

A 2017 web archive verifies that KnownCircle offered customer-relationship, email, gift-card, and digital-marketing tools to insurance agents, realtors, and other service providers; the archive is not an incident notice. knowncircle.com currently redirects to another Known-branded page and no longer presents the former service. The company link therefore opens the incident-period archive.

Production has no import job associated with the KnownCircle identity, and the email, username, password, identity, phone, IP, personal-field, sensitive-data, and general breach-data collections all contain zero local associations. The external email measure is not presented as locally searchable records. A former KnownCircle staff password should be changed wherever it was reused. Other people should independently verify real-estate or insurance messages that use a name, email, phone number, or address through a known institutional channel.