Unprotected Database Leak Exposes 9.36 M Personal and Employer Records from Adapt
What Happened – In November 2018 security researcher Bob Diachenko discovered that Adapt, a provider of “Fresh Quality Contacts,” was hosting an unprotected database. The exposed data set contained 9,363,740 unique records, including names, email addresses, phone numbers, physical addresses, job titles, employer details, and social‑media profile links.
Why It Matters for Trust & Control Assurance
- The incident is a textbook example of a configuration‑control gap that a continuous control‑assurance program is built to detect and remediate.
- Demonstrating that data stores are properly hardened, access‑controlled, and regularly audited provides defensible evidence for audits and regulator inquiries.
- Mapping this gap to a single control objective (secure configuration and access management) satisfies multiple framework requirements simultaneously, reinforcing the organization’s overall trust posture.
Who Is Affected – Companies that rely on third‑party contact‑enrichment services, marketing and sales teams, and any organization whose employees’ contact information was stored in the Adapt database (broadly across technology, professional services, and B2B sectors).
Recommended Actions
- Inventory all external data‑provider integrations and verify that each data store is protected by authentication and network segmentation.
- Implement a continuous configuration‑monitoring process that flags any publicly accessible storage assets.
- Collect and retain evidence of access‑control policies, change‑management logs, and periodic audit reports to demonstrate compliance readiness.
Source: Have I Been Pwned – Adapt breach
Technical Notes – The exposure resulted from a misconfigured, unauthenticated database endpoint. No known CVE applies; the root cause is a lack of proper access controls and network segmentation. Data types exposed include personally identifiable information (PII) and employer‑related business data.