Massive Data Breach: 183 Million Business Records for Sale on Dark Web
More than 183 million records containing contact details and employment information have been stolen from a data broker and listed for sale on the dark web. A seller using the alias KryptonZambie has offered the dataset for $6,000 on a cybercriminal forum. As a sample, potential buyers can access 100,000 records. According to the seller, the leaked information includes corporate email addresses, physical addresses, phone numbers, employer names, job titles, and links to LinkedIn profiles and other social media accounts.
The data is believed to have originated from Pure Incubation, now operating under the name DemandScience. The company has acknowledged awareness of the sale and clarified that the leaked information comprises business contacts that were already publicly accessible. DemandScience stated that it processes only publicly available business contacts and does not store sensitive personal data such as passwords, home addresses, or other confidential information.
The company also assured that the data breach was not a result of its systems being compromised. Earlier this year, it became aware of a hacker forum post claiming that data had been stolen from outdated Pure Incubation systems. However, an investigation revealed no evidence of infrastructure intrusion. Nonetheless, the company conceded that legacy data could have leaked through a contractor or partner, though there is no direct proof to substantiate this claim.
DemandScience specializes in collecting and selling business contact information for marketing campaigns. Essentially, it operates as a data broker, aggregating identifiers from public sources and selling them to companies for targeted advertising purposes.
The data breach monitoring service Have I Been Pwned (HIBP) has verified the incident and added the leak to its database. According to HIBP, the breach impacted at least 122 million unique email addresses previously collected by Pure Incubation. HIBP founder Troy Hunt analyzed the data and discovered his own contact details among the records, including an outdated email address and incorrect job information. Hunt noted that a victim of the breach contacted DemandScience and was informed that the leaked data originated from a system decommissioned two years ago.
The cybersecurity website HackManac also highlighted the breach, sharing a screenshot of KryptonZambie’s post, which claimed that 183.7 million records were up for sale.
