Public Business 2021 Data Breach
Data Broker / Business Intelligence Exposure · Public business records and executive identity data · Public-business intelligence corpus sourced from Orbis customer data · Global
Orbis Business Intelligence Database Breach: 27M Executive Records Including DOB & Job Titles
Orbis database of executive contact data, operated by Bureau van Dijk (Moody's)
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
24/100
Lower riskHigher risk
Lower: limited current risk based on data value and recency.
Data Sensitivity i
StandardExposed data is largely lower-sensitivity. Standard identity-protection precautions are advised.
27.9MRecords
2021Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
AddressPhysical address
Breach Summary
Around August 2021, hundreds of gigabytes of business data compiled from public sources via Bureau van Dijk’s Orbis product were obtained from a BvD customer and later published on a hacking forum. The corpus (around 426GB / 484 million lines) contained 27,917,714 unique email addresses along with names, phone numbers, dates of birth, physical (largely corporate) addresses, job titles, company names, and some tax identifiers. BvD stated its own systems were not breached.
Full threat analysis, exploitation vectors, and principal guidance below.
10 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
27.9M records analyzed
About Public Business
Bureau van Dijk, a Moody’s company, aggregates business and corporate information (including its Orbis product) covering companies and associated individuals worldwide.
Why They Hold Your Data
Public-business intelligence corpora aggregate executive identity, company records, corporate ownership, and public-business profile data into searchable commercial datasets.
Recent Developments
Bureau van Dijk stated there was no unauthorized access to its own systems; the leaked corpus came from a customer of its Orbis product and was published to a hacking forum.
Data Points Exposed
6 verified field types
Date of Birth High
Email Address
Full Name
Job Information
Phone Number
Physical address High
Breach Impact
The business-contact and identity data supports large-scale spear-phishing and business-email-compromise reconnaissance; because it is aggregated from a data-broker product, individuals had no direct relationship with the source.
Exploitation & Downstream Threats
• Identity verification bypass using name + date of birth combination | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure | • Employment-based social engineering using job and employer data
Principal Risk Advisory
What this means for a principal
A data-broker/identity breach: aggregated identity attributes re-seed broker networks and enrich targeting of the individual. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
What You Should Do
- Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation