Whitepages 2016 Data Breach
Data & Identity / Data Brokers
Whitepages 2016 Data Breach
A telephone and address directory service.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
24/100
Lower riskHigher risk
Lower: limited current risk based on data value and recency.
Data Sensitivity i
StandardExposed data is largely lower-sensitivity. Standard identity-protection precautions are advised.
11.7MRecords
2016Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Breach Summary
In mid-2016, the telephone and address directory service Whitepages was among a raft of sites that were breached and their data then sold in early-2019. The data included over 11 million unique email addresses alongside names and passwords stored as either a SHA-1 or bcrypt hash.;What happened in the Whitepages, Breach? November 30th 2024, 7:00 pm EST, In mid-2016, Whitepages, a telephone and address directory service, experienced a data breach, and the compromised data was later sold in early 2019.
Full threat analysis, exploitation vectors, and principal guidance below.
12 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
11.7M records analyzed
About Whitepages
Whitepages is a telephone and address directory service.
Why They Hold Your Data
Whitepages is a telephone and address directory service. Services like this typically hold email addresses, names, passwords through account registration and normal operations.
Recent Developments
The Whitepages dataset circulated publicly; treat as part of the standing exposure landscape.
Data Points Exposed
3 verified field types
Email Address
Full Name
Password High
Breach Impact
The exposure of credentials alongside personal data heightened account-takeover and reuse risk for Whitepages users and drew scrutiny of its data protection.
Exploitation & Downstream Threats
• Credential stuffing against reused passwords across other platforms | • Targeted phishing campaigns using exposed email addresses
Principal Risk Advisory
What this means for a principal
A data-broker/identity breach: aggregated identity attributes re-seed broker networks and enrich targeting of the individual. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.
What You Should Do
- Reset any reused passwords and enable MFA on email first, then financial accounts.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping: cross-reference the exposed identifiers against broker-available data to size and prioritize the principal's wider footprint.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
G
Threat Actor: GnosticPlayersConfidence: Medium
Motivation: Financial
A prolific breach seller persona active around 2019 and associated with large batches of stolen account databases. Some modern reporting groups GnosticPlayers with the broader ShinyHunters data-theft ecosystem, but that relationship should be handled cautiously.
This breach is linked to the GnosticPlayers batches (2019) campaign (2019 related breaches tracked by ObscureIQ). See the full campaign analysis →
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation