A 437GB dataset labeled "Acuity" surfaced online in mid-2020 and was subsequently distributed across hacking forums, exposing records tied to approximately 241.8 million individuals. The origin of the dataset has not been confirmed. No organization named Acuity has publicly acknowledged responsibility for the data, and cybersecurity researchers have been unable to attribute it with confidence to any known company, including Acuity Scheduling. The dataset spans more than 400 data fields per record. The exposed information includes names, phone numbers, physical addresses, email addresses, dates of birth, genders, and IP addresses. With over 14 million unique email addresses and this breadth of demographic detail, the dataset is highly useful for identity linkage, targeted phishing, and fraud. The combination of address, date of birth, and contact information is sufficient to enable convincing impersonation and social engineering attacks. No legal actions or regulatory investigations related to this dataset have been publicly reported. Because attribution remains unconfirmed, formal notification to affected individuals has not occurred. People whose information appears in the dataset face real risk of identity theft, profiling, and misuse by data brokers or fraudsters, regardless of how the data was originally compiled or leaked.

This dataset appears to be a large, widely distributed corpus attributed to an entity called “Acuity,” containing extensive personal records across hundreds of columns, including names, phone numbers, physical addresses, genders, and dates of birth. The source was not confidently verified to a known Acuity company.

Acuity Scheduling continues to operate as an active Squarespace-owned product with enterprise positioning, privacy documentation, and guidance for regulated use cases such as HIPAA-aligned workflows. Its current public materials emphasize secure client data handling, enterprise controls, and deeper integration into the broader Squarespace ecosystem.