Slashdot Mirror
Marketing Firm Exactis Leaked a Personal Info Database With 340 Million Records (wired.com)
You've probably never heard of the marketing and data aggregation firm Exactis. But it may well have heard of you. And now there's also a good chance that whatever information the company has about you, it recently leaked onto the public internet, available to any hacker who simply knew where to look. From a report: Earlier this month, security researcher Vinny Troia discovered that Exactis, a data broker based in Palm Coast, Florida, had exposed a database that contained close to 340 million individual records on a publicly accessible server. The haul comprises close to 2 terabytes of data that appears to include personal information on hundreds of millions of American adults, as well as millions of businesses. While the precise number of individuals included in the data isn't clear -- and the leak doesn't seem to contain credit card information or Social Security numbers -- it does go into minute detail for each individual listed, including phone numbers, home addresses, email addresses, and other highly personal characteristics for every name. The categories range from interests and habits to the number, age, and gender of the person's children.
"It seems like this is a database with pretty much every US citizen in it," says Troia, who is the founder of his own New York-based security company, Night Lion Security. Troia notes that almost every person he's searched for in the database, he's found. And when WIRED asked him to find records for a list of 10 specific people in the database, he very quickly found six of them. "I don't know where the data is coming from, but it's one of the most comprehensive collections I've ever seen," he says.
"It seems like this is a database with pretty much every US citizen in it," says Troia, who is the founder of his own New York-based security company, Night Lion Security. Troia notes that almost every person he's searched for in the database, he's found. And when WIRED asked him to find records for a list of 10 specific people in the database, he very quickly found six of them. "I don't know where the data is coming from, but it's one of the most comprehensive collections I've ever seen," he says.
anyone?
if you see me, smile and say hello.
Data is the fuel that powers Exactis. Warehousing over 3.5 billion consumer, business, and digital records, The Exactis Data Cloud provides knowledge and insight to hundreds of firms enabling them to achieve marketing success through the use of high quality data. The Exactis data cloud is one of the largest and most respected in the data marketing industry. It is constructed of hundreds of compiled and proprietary data sources, has over 400 different selects, and utilizes a triple verification process to guarantee accurate targeting. This includes demographic, geographic, firmographic, lifestyle, interests, CPG, automotive, and behavioral data.
nothing to see here - move along
At this point, there have been so many "leaks" (whatever the fuck that means) of PI that we have reached a point where there simply is NO remaining PI for anyone older than 18 months old. It's all out there now. Everything about you is in the wild, including things you didn't know about yourself. Everyone now lives in a fishbowl. Get used to it.
I have a modest proposal. To even the playing field (and to make hoarding PI no longer profitable) there ought to be a national database of all our PI that has an open API for anyone wants to access, at any time. Period. One and done. "Securing" PI would then be a form of theft, a felony. Anyone caught collecting and storing PI outside the public domain would be arrested for information crimes (espionage) and if convicted, thrown in prison.
=^..^= all your rodent are belong to us
Greg Williams COO Greg brings over 20 years of Internet marketing experience as both an Internet entrepreneur and operational leader in the data and digital marketplace. During his tenure, he has developed a multitude of successful business relationships that continue to thrive. Greg oversees the day to day operations of Exactis and plays an integral role in our platform and data development projects including but not limited to data123.com, autoappend.com, and dataverification.com. but nothing about security... William Pearson CTO Will is a highly accomplished IT Executive designing and developing self-service software applications built on BIG Data, running in Cloud Infrastructure in highly secure environments, leveraging analytics and yielding high profits and rapid growth. He is responsible for technology strategy which includes highly accurate and automated data processing, cloud infrastructure, MS Azure platform-as-a-service, Cloudera / Hadoop Data Management Platform, APIs, Marketing Automation Platform, Analytics, and Digital Marketing.
nothing to see here - move along
At this point can we get Elon Musk to make a special one-way rocket so we can fire all the marketing and sales people into the Sun?
I'm sure we can get a highly successful GoFundme for this.
and think that's a lot of vinyl and do a double take?
Sorry, I just thought it went with the theme
Bingo!
Screw the "corporate veil". Until someone in the management structure of the companies that collect all this data--and then allow it to leak onto public networks--goes to jail for most of their remaining years, they're simply not going to take data security seriously enough.
CUR ALLOC 20195.....5804M
These are the companies that the GDPR was meant to go after. Companies nobody knows what they do, slurp tons of data, get hacked, and cause all kinds of trouble. If they have any Europeans on their rolls, people should send them the GDPR Letter From Hell.
It would be nice if we saw similar protection laws here in the US.
Cause they don't leak at all either.
Government regulation is for CHUMPS! Boo yah!
#DeleteChrome
I also had fleeting hope that Experian would be driven out of business. Oh well...
If I collected that much data on a just a handful of random people I would be called a serial stalker and brought up on charges. Why doesn't the same thing happen to these companies?
I also wonder with all of these giant data brokers out there collecting this much data on everyone why is it so many companies screw the pooch when trying to collect debts. For example couple years back I had a case where a debt collector was trying to collect a student loan debt from me that was older than I am and the only match was on the first name.
Time to offend someone
When a company cannot secure the PI data it collects, then it should pay a fine for each person's data that it exposed.
Call the fine $120, which should be the low ball of credit monitoring for a year. (https://www.creditcards.com/credit-card-news/pros-cons-credit-monitoring-services-1282.php)
This amount should be payable to each person to do with as they wished. (I have multiple credit monitoring plans being ran on me already this year. I'd rather have the cash.)
It seems that this is only one of many companies that collect public data.
You know, I've given up ... it's time to start physical beatings of the assholes who work for companies like this, and to start cutting off fingers when they leak this shit.
I didn't consent to you having my information, I don't have a business relationship with you, and I don't want you to have my fucking data.
These people are fucking parasites, utterly incompetent at data privacy and security (because they're lazy and greedy) .. and if lawmakers aren't going to rein in these assholes, then someone needs to.
Say what you will about the GRDP, but it at least seems to get the point that we're not here to be a profit center for some greedy asshole of a marketing company.
If nothing else, get a fucking list of their employees, publish their personal information, and everybody go and take a shit on their lawn (or car).
And people wonder why I have ad blockers and block the shit out of this stuff.
GDPR would bankrupt companies like this overnight. The US should do the same.
Lifetime imprisonment without parole for the CEO and everyone under him in the chain of command, who were responsible for this data breach. The attorney general of Florida should act on this case immediately. This case should set a precedent throughout the USA, for companies to safeguard personal information about US citizens.
This is what I though, after reading: "Exactis leaked..."
OK, so corporations want to be people? Fine.
Take 'em to court. Presumably they'll lose with a fine and jail-time. The company pays the fine, and as the jail time? That's for the CEO.
He's the "brains" and "leader" of the operation? Let's treat him exactly that way.
If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
With all these huge data breaches lately, why hasn't anyone leaked everything on the politicians in Congress (both parties) and CEOs of the data harvesting companies? Yes, it not nice. Yes, it is divulging personal information. But seems the only way to pass laws which meaningfully punished these companies, their boards and CEOs, CTOs, etc. is when those in power suffer like the average person. Until then, they take their bribes^H^H^H^H^H^Hcampaign contributions and nothing will change.
Ever wonder why there are so many hacks of big databases. It's not the "security infrastructure" that is to blame, instead it is that crypto has been completely made irrelevant by some big crime groups, who have quantum (yes, that quantum) computers. This is just the beginning, and the feeding frenzy is about to start ...