Exactis — 340 Million Records of Profiling Data Nobody Consented To (2018)
If you have an account with Exactis, here’s what’s now in circulation.
A marketing data broker left an ElasticSearch node exposed with no firewall. It held about 340 million records across hundreds of fields — religion, ethnicity, net worth, whether you smoke, the ages and genders of your children. This is what the broker industry holds on people who never heard of it.
What happened
In June 2018 the marketing firm Exactis inadvertently exposed roughly 340 million records of personal data. Security researcher Vinny Troia of Night Lion Security found it with a Shodan search for ElasticSearch instances on publicly accessible servers — the database was reachable with no firewall protection at all. A subset of the fields was provided to Have I Been Pwned and contained 131,577,763 unique email addresses.
Reporting at the time put it at around 230 million records on individuals and 110 million on businesses — larger, by record count, than the Equifax breach of the previous year.
Read the field list. That is the whole story.
Most breach pages list four or five data classes. The catalogue lists twenty for Exactis, and they are worth naming rather than summarising: name, email address, phone number, physical address, date of birth, gender, marital status, family structure, home-ownership status, income level, net worth, credit status, financial investments, occupation, education level, ethnicity, religion, spoken languages, personal interests and IP address.
Contemporary reporting described the profiling fields in more detail still — whether a person smokes, whether they own pets, and the number, age and gender of their children.
There were no passwords and no credit card numbers. There was also, for essentially everyone in it, no relationship with Exactis. Nobody signed up. The company described itself as a compiler and aggregator of premium business and consumer data, and sold profiles for marketing purposes. Your record existed because it was assembled about you.
Why this one is different from every other page here
Every other breach on this list is a company losing data its users gave it. This is a company losing data nobody gave it — and the loss is almost beside the point. The profile existed, priced and for sale, before the ElasticSearch node was ever found. The breach did not create the exposure; it made the exposure visible.
Religion and ethnicity in a commercial marketing file are not neutral demographic markers. They are the fields that make discriminatory targeting and harassment operationally cheap, and they are exactly the categories that subsequent privacy law treats as special.
The identity-chain implication
This is the shape of the problem GalaxyWarden's removal work exists to address, and it is why a breach scan alone is not a complete answer. Leaked breach data cannot be deleted — once a dump is circulating, it circulates. Broker listings can be removed, because the broker is a real company with a legal obligation and a removal process.
Exactis is one firm. The industry is hundreds of them, holding comparable profiles, most of which have not left a database open to the internet and are therefore invisible. The Exactis leak is the rare occasion when the contents of that industry became publicly inspectable.
What to do now
What You Should Do
- Understand that you cannot close an account here — you never had one; the removals that matter are at the brokers still holding the same profile
- Submit removal requests to the people-search and broker sites publishing your address and relatives, which is the removable half of this exposure
- Stop using date of birth, mother's maiden name or home town as security answers — all of them are commercial data fields
- Assume marketing calls and mail that know your income, home ownership or family structure are sourced, not guessed
- Check what is publicly listed about your household, since family structure and children's ages were part of the profiling set
What the free scan actually returns
Found on people-search siteswe remove these
These listings are live, public, and legal to remove. That’s what a Deep Sweep buys.
Found in breach recordsverifiedreported — unverified
Each record is labeled: confirmed breach data, or an attacker’s claim no one has verified.
Leaked data cannot be deleted from the internet — anyone claiming otherwise is lying. Broker listings can be removed. We do the second, and show you exactly what to fix from the first.
Report details & sourcing
Related breaches
Verifications.io — 763 Million Email Records Left on an Open Database (2019)
An email-validation firm most people had never heard of left 763 million records in a MongoDB instan…
Navia Benefits Administration Breach — March 2026
2.7 million individuals had names, SSNs, DOBs, contact information, and benefits administration data…
Gravatar — 114 Million Email Addresses Recovered From Avatar URLs (2020)
Gravatar identifies you by the MD5 hash of your email address, published in the URL of your avatar o…
