ClearVoice Surveys Breach Exposes 15.1 M Accounts via Public Backup Leak
What Happened – In April 2021 a 2015 database backup of market‑research firm ClearVoice Surveys was found publicly on a hacking forum. The backup contained 15,074,786 unique records with names, email addresses, dates of birth, genders, IP and physical addresses, phone numbers, and plain‑text passwords. ClearVoice confirmed the breach and its authenticity.
Why It Matters for Trust & Control Assurance
- This incident illustrates the risk of unprotected backup storage, a control gap that continuous‑control programs are built to detect and evidence.
- Demonstrates the need for ongoing configuration monitoring and auditable proof that backups are restricted to authorized personnel only.
- Highlights the importance of credential protection and rapid password rotation as part of a defensible audit trail.
Who Is Affected – SaaS providers in the market‑research and survey space, as well as any organization that stores personally identifiable information (PII) in backups.
Recommended Actions
- Audit all backup repositories for public exposure; remediate any misconfigurations immediately.
- Deploy continuous monitoring tools that capture backup‑access logs as evidence of control enforcement.
- Force password resets for all compromised accounts and enable multi‑factor authentication.
Technical Notes – The exposed data originated from a 2015 backup that was inadvertently left on a publicly reachable server. No specific vulnerability (CVE) was disclosed; the breach resulted from a misconfiguration that made the backup discoverable. Source: https://haveibeenpwned.com/api/v3/breach/ClearVoiceSurveys