Exactis data exposure

In June 2018, security researcher Vinny Troia discovered that Exactis — a little-known data-marketing and aggregation firm based in Palm Coast, Florida — had left a database of nearly 340 million records sitting on a publicly accessible server with no firewall in front of it. There was no hack and no attacker: the data was simply exposed to anyone who knew where to look. By record count it was one of the largest known exposures of U.S. personal data, surpassing even the Equifax breach.

What happened

Troia found the database while scanning the internet for exposed Elasticsearch instances using the Shodan search engine. He came across an Exactis-owned database that was reachable on a public IP address with no access controls. Anyone could query it.

The exposure totaled around 2 terabytes of data and roughly 340 million records — approximately 230 million on individual consumers and 110 million on business contacts. Critically, this was not just names and emails. Each record reportedly contained up to 400 separate fields of granular profiling data.

What was exposed

The records went far beyond basic contact information. Exposed fields reportedly included:

• Names, physical and email addresses, and phone numbers.
• Highly personal attributes: the number of children in a household and their ages and genders, marital status, religion, ethnicity, and personal interests and habits.
• Financial and lifestyle signals: estimated home value, whether the person owns stock, the type of credit cards they hold, their credit standing, and political donation history.

Notably, the data did not appear to include Social Security numbers or credit-card numbers — but the breadth of behavioral and household profiling made it deeply sensitive in aggregate, the kind of dossier used for targeting and potentially for social-engineering or fraud.

Impact

• An estimated 340 million records exposed, covering a substantial share of the U.S. adult population and millions of businesses.
• After being notified, Exactis secured the database and took it offline; there is no public confirmation that malicious actors copied the data before it was locked down.
• Class-action lawsuits were filed against Exactis in the weeks following the disclosure.
• The incident intensified scrutiny of the data-broker industry — companies that compile and sell detailed consumer profiles, often without the knowledge or consent of the people described.

Why it matters

Exactis crystallized a uncomfortable truth about the modern data economy: the most damaging leaks need not involve any hacking at all. A single misconfigured, internet-facing database at an obscure broker most consumers had never heard of put intimate details about hundreds of millions of people within reach of anyone scanning the internet. It became a leading example in the debate over data-broker regulation and consent, and a standard cautionary tale about securing cloud and Elasticsearch deployments — locking down public access, requiring authentication, and not exposing bulk personal data to the open internet.