105 Million Corporate America Records Exposed in “B2B USA Businesses” Spam List
What Happened – A spam list containing 105,059,554 records from U.S. corporate employees was posted publicly in mid‑2017. The list includes personal and professional identifiers: email address, employer, job title, work phone, and physical address.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate data‑inventory and classification controls – a core control area that continuous‑monitoring programs must evidence.
- Highlights the need for documented privacy‑by‑design practices (consent, minimisation, retention) that can be shown to auditors as defensible evidence.
Who Is Affected – Large‑scale B2B enterprises across most verticals (finance, technology, manufacturing, professional services, etc.) that store employee contact information.
Recommended Actions
- Verify and update your personal‑data inventory; map each data element to a privacy control.
- Review consent and data‑minimisation policies; ensure you can produce evidence of lawful processing.
- Deploy a privacy‑consent management solution and capture audit‑ready logs of data‑handling activities.
Source: Have I Been Pwned – B2B USA Businesses breach
Technical Notes
- Attack vector: unknown – the list appears to have been compiled from one or more prior compromises and later aggregated for sale.
- No specific CVE or vulnerability disclosed.
- Data types exposed: email addresses, employer names, job titles, phone numbers, physical addresses.
Source: same as above