[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1b955yhaypt8w":3},{"success":4,"breach":5},true,{"_id":6,"name":7,"title":8,"slug":9,"domain":10,"breachDate":11,"addedDate":12,"modifiedDate":12,"contentUpdatedAt":13,"source":14,"sourceUrl":15,"sourceUrls":16,"pwnCount":18,"affectedCount":18,"affectedCountStatus":19,"affectedCountLowerBound":20,"affectedCountUnit":21,"hasEnglishDescription":4,"severity":22,"dataClasses":23,"description":25,"seoTitle":10,"seoTitleEn":26,"seoDescription":10,"seoDescriptionEn":27,"logoUrl":28,"isVerified":4,"isSensitive":29,"isSpamList":29,"isMalware":29,"company":30},"68e3266eda11adda488252e2","NotSOCRadar","Not SOCRadar Data Breach","not-socradar","","2024-08-03T00:00:00.000Z","2024-08-09T09:28:24.000Z","2026-07-18T23:55:11.809Z","Verified breach record","https:\u002F\u002Fsocradar.io\u002Fsocradars-response-to-the-usdods-claim-of-scraping-330-million-emails\u002F",[15,17],"https:\u002F\u002Fwww.scworld.com\u002Fbrief\u002Fover-300m-scraped-socradar-io-emails-exposed",282478425,"known",null,"unknown","Critical",[24],"Email addresses","\u003Cp>The Not SOCRadar incident is related to a large dataset consisting of hundreds of millions of lines of email addresses, published on a cybercrime forum in August 2024. Although the sharing was initially associated with the name SOCRadar, verified assessments indicate that it cannot be described as unauthorized access to company systems or a customer data breach. The main characteristic of the dataset is that lists of email addresses collected from public Telegram channels and similar accessible areas circulated in large volumes.\u003C\u002Fp>\u003Cp>This distinction is critical in terms of user security. It should not be concluded that a person whose information is matched has a SOCRadar account, is a SOCRadar customer, or that personal files have been obtained from the person's company's internal systems. The correct assessment is that the email address alone is visible, yet it is exposure to a large-scale list that increases the risk of spam, phishing, and account discovery. Therefore, the incident should not be described either in exaggerated corporate breach terms or as if there is no risk at all.\u003C\u002Fp>\u003Ch2>Leaked Data Types and Risks\u003C\u002Fh2>\u003Cp>The verified data type is only email addresses. Passwords, password hashes, phone numbers, physical addresses, payment information, identification documents, or account content are not among the verified fields for this incident. Although it appears to be a single field, the email address is an important starting point in attack chains. The presence of an address on the list can show the attacker that the person is a real user and is associated with a specific domain.\u003C\u002Fp>\u003Cp>Email addresses are specifically used for targeted phishing, bulk spam, password reset attempts, account creation verification, and matching with old leaks. Corporate addresses can provide clues about the employee's name, department, or company. Personal addresses, on the other hand, can be attempted to match with social media, shopping, finance, and job application accounts. Therefore, even if only the email field is verified, the risk level of the incident is high due to volume and potential misuse.\u003C\u002Fp>\u003Ch2>Verified Scope and Boundaries\u003C\u002Fh2>\u003Cp>The verified scope consists of 282,478,425 unique and validly formatted email addresses. In the initial sharing, the number of lines was expressed as higher; however, the number that should be considered from the user's perspective is the number of unique addresses. The event date is considered as August 3, 2024, and it was added to the reliable lists on August 9, 2024. The same date is also consistent with the date of the last verified change.\u003C\u002Fp>\u003Cp>The boundary of this incident should be clearly maintained: verification confirms the exposure of the email list; it does not confirm that SOCRadar security systems have been compromised. The statement should avoid using definitive expressions such as that the company's customers were directly endangered, internal systems were exposed, or confidential customer data was taken. The record name should also reflect this distinction; the message given to the user should focus on the risk to the broad email list rather than the allegation of an institutional breach.\u003C\u002Fp>\u003Ch2>User Groups at Risk\u003C\u002Fh2>\u003Cp>The at-risk group consists of individual users with email addresses listed and corporate domain names. Work addresses can become targets for messages involving sales, accounting, support, human resources, and executive impersonation. General communication boxes may also encounter messages themed around fake offers, fake invoices, alleged security warnings, or file sharing.\u003C\u002Fp>\u003Cp>The risk for personal addresses increases when the same address is used across different services. Attackers may combine these addresses with previously leaked password lists to initiate account takeover attempts. Since the only type of data is email, it cannot be said that the person's financial or official identity information is exposed from this incident; however, the inclusion of the address in a verified target list can make malicious messages reaching the inbox appear more convincing.\u003C\u002Fp>\u003Ch2>Urgent Measures to Be Taken\u003C\u002Fh2>\u003Cp>Users in the matching area should first check the security of their email account. The account password should be unique and strong, and the same password should not be used for other services. Two-factor authentication should be enabled, recovery email and phone information should be kept up to date, and unknown sessions should be closed. Although the email address alone does not require a password change, this check is a priority because the email account serves as the recovery center for many other accounts.\u003C\u002Fp>\u003Cp>The next step is inbox behavior. Users should check the sender's domain and the context of the message before clicking on links in messages related to payment, billing, shipping, security alerts, file sharing, and account verification. For institutions, the incident should be accepted as a signal to update email security rules, employee awareness, and high-risk address lists. Unexpected attachments should not be opened, and messages requesting login codes should be verified through a second channel.\u003C\u002Fp>\u003Ch2>Long-Term Security Strategies\u003C\u002Fh2>\u003Cp>In the long term, users should consider using unique email aliases or separate contact addresses for important accounts. Linking critical financial, business, and executive accounts to a single general address creates risk. Using a password manager, generating different passwords for each account, and closing old accounts reduces exposure. On the corporate side, correctly maintaining DMARC, SPF, and DKIM settings decreases the risk of fraudulent senders.\u003C\u002Fp>\u003Cp>Large email lists can be combined with other data sets over time. Therefore, the security approach should not be limited to this incident alone. It should be regularly monitored whether the same address appears in other incidents containing passwords, usernames, phone numbers, or addresses. Mail security solutions should block risky links and attachments, employee training should be supported with realistic phishing scenarios, and additional login verification should be applied for high-privilege accounts.\u003C\u002Fp>\u003Ch2>Record Control and User Action\u003C\u002Fh2>\u003Cp>If the result of LeakData is positive, it is understood that the email address is found in the Not SOCRadar dataset. This result does not indicate that the user has an account with the SOCRadar service or is a company customer. The meaning of the result is that the address is on a large email list and the likelihood of misuse is increased. The user should strengthen login security, especially for important accounts used with the same address.\u003C\u002Fp>\u003Cp>If the result is negative, it is understood that there is no match in this data set; however, the same address may appear in different lists at other times. Therefore, regular monitoring, unique passwords, two-step verification, and careful email usage should be maintained. Corporate security teams should consider addresses belonging to domain names appearing on such lists as an early warning for spam and phishing defenses.\u003C\u002Fp>","Not SOCRadar Data Breach (282.5 Million Reported Records)","Not SOCRadar Data Breach. 282.5 Million reported records were reported. Reported data: Email addresses. Review the scope, risks, and protective steps.","\u002Fuploads\u002Flogo\u002Fnot_socradar.webp",false,{"name":31,"sector":32,"country":10,"website":10,"websiteArchiveUrl":10,"websiteStatus":10,"websiteCheckedAt":20},"Not SOCRadar","Public Data Collection"]