Exactis, a Florida-based marketing data broker, exposed a database of roughly 340 million consumer and business records in June 2018 after leaving it publicly accessible due to a misconfiguration. Security researcher Vinny Troia of Night Lion Security discovered the leak, which spanned multiple terabytes across hundreds of data fields. No external attacker was required. The data was simply open on the internet. Around 110 million individuals are confirmed affected, with a subset of 132 million unique email addresses later added to the public breach notification service Have I Been Pwned. The exposed records were unusually detailed for a data breach. Beyond names, email addresses, phone numbers, and physical addresses, the dataset included dates of birth, income levels, net worth, financial investments, home ownership status, family structure, marital status, religion, ethnicity, spoken languages, education levels, occupations, and personal interests. Exactis compiled and sold this kind of profiling data to businesses for marketing and targeting purposes. Its exposure creates serious risk for affected individuals, including identity theft, phishing attacks tailored with personal details, and misuse by people-search services or other data aggregators. No major regulatory action or class-action settlement has been publicly confirmed in connection with this breach. Because Exactis collected data on people who never directly interacted with the company, many affected individuals had no way of knowing their information was held there in the first place. Anyone who may be included should be alert to targeted phishing attempts and consider monitoring their credit and identity for signs of misuse.

Marketing data brokers aggregate consumer and business identity, contact, demographic, behavioral, and profiling data across advertising, analytics, and enrichment workflows.

Exactis’ public corporate profile appears to have largely collapsed after the 2018 exposure. Reporting in 2019 described the company as effectively finished as a business after customers and partners pulled away, and there is little visible evidence today of a meaningful operating presence beyond legacy references and dormant company information.