Acuity Data Breach Exposes 14 M Personal Records
What Happened — A 437 GB data set attributed to “Acuity” was publicly released in mid‑2020, containing 14,055,729 unique records. Each record includes name, email, phone, physical address, gender, date of birth, IP address and other personal attributes.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate data‑handling policies and missing evidence of consent for personal information.
- Highlights the need for continuous privacy‑control monitoring and auditable proof that data is protected, retained, and disposed of per regulatory expectations.
- Shows how a lack of documented incident‑response processes can leave organizations without a defensible audit trail after a breach.
Who Is Affected – Organizations that collect, store, or process large volumes of personally identifiable information (PII), especially SaaS platforms handling customer relationship data.
Recommended Actions – Review and tighten privacy‑control frameworks, map consent and data‑retention policies to your audit‑readiness program, and collect continuous evidence of compliance with data‑protection objectives. Source: https://haveibeenpwned.com/api/v3/breach/Acuity
Technical Notes – The breach source could not be definitively linked to a known Acuity entity; the exposure appears to be a large‑scale data dump rather than a single exploited vulnerability. No CVE or specific technical flaw is identified. Source: https://haveibeenpwned.com/api/v3/breach/Acuity