Email verification service takes itself offline after 800 million records get publicly exposed

Researchers find a non-protected MongoDB instance amounting to 150GB of unique data

Image depicting email security

An online email verification service has taken itself offline after approximately 809 million of its customers' emails were exposed through an unprotected server.

Researchers discovered a non-password protected MongoDB instance amounting to 150GB of data split across four separate collections last week. They analysed this exposed data, 808,593,939 records in total, and published their findings on Thursday.

The exposed records are owned by an email verifications service named Verifications.io, according to the researchers.

The largest drive, named 'mailEmailDatabase', itself contained three folders; Emailrecords (798,171,891 records exposed), emailWithPhone (4,150,600 records exposed) and businessLeads (6,217,358 records exposed).

Beyond names, email addresses and phone numbers, the exposed records may also have contained additional information such as city, phone number, date of birth, and gender.

Cyber security expert Bob Diachenko, who discovered and analysed the exposed data with NightLion Security's Vinny Troya, then cross-referenced these records with the HaveIBeenPwned database.

They established these were unique records that had never been exposed in any previous 'collections'. Included in this bracket, for example, are the monster Collections #1 to #5 leaks of 2.2 billion unique records exposed earlier this year.

"This is perhaps the biggest and most comprehensive email database I have ever reported," Diachenko wrote in his post.

"Upon verification, I was shocked at the massive number of emails that were publicly accessible for anyone with an internet connection. Some of data was much more detailed than just the email address and included personally identifiable information (PII)."

Clues within the dataset pointed Diachenko to Verifications.io as the likely owner of the non-password protected MongoDB instance.

The company, which offers 'enterprise email validation' as a service, then took its entire website offline the same day he reported the discovery to its support team.

"We appreciate you reaching out and informing us," Verifications.io's support team told Diachenko via email. "We were able to quickly secure the database. Goes to show, even with 12 years of experience you can't let your guard down.

"After closer inspection, it appears that the database used for appends was briefly exposed. This is our company database built with public information, not client data."

This fact has confused the researchers, however, who in their blog post posed the question "why close the database and take the site offline if it indeed was "public"?"

Verifications.io remains offline at the time of publication.

Featured Resources

Five lessons learned from the pivot to a distributed workforce

Delivering continuity and scale with a remote work strategy

Download now

Connected experiences in a digital transformation

Enable businesses to meet the demands of the future

Download now

Simplify to secure

Reduce complexity by integrating your security ecosystem

Download now

Enhance the safety and security of your people, assets and operations

Enable a true vision of security with an engineered solution based on hyperconverged and storage platforms

Download now

Recommended

'Largest ever' Magecart hack compromises 2,000 online stores
hacking

'Largest ever' Magecart hack compromises 2,000 online stores

15 Sep 2020
Infocyte integrates with Palo Alto Networks Cortex XSOAR
cyber security

Infocyte integrates with Palo Alto Networks Cortex XSOAR

19 Aug 2020
Andrew Daniels joins Druva as CIO and CISO
Cloud

Andrew Daniels joins Druva as CIO and CISO

22 Jul 2020
University of California gets fleeced by hackers for $1.14 million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020

Most Popular

Google Pixel 4a review: A picture-perfect package
Google Android

Google Pixel 4a review: A picture-perfect package

18 Sep 2020
Accenture ploughs $3 billion into cloud migration support group
digital transformation

Accenture ploughs $3 billion into cloud migration support group

17 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020