Exactis Data Leak Exposes 131.6 M Personal Records
What Happened — In June 2018 the marketing data‑aggregator Exactis unintentionally made a public dump of over 340 million personal records available. Researchers identified 131,577,763 unique email addresses plus dozens of profiling fields (names, addresses, income, ethnicity, etc.).
Why It Matters for Trust & Control Assurance
- The breach is a textbook example of a control gap that a continuous‑control‑assurance program is designed to detect and evidence.
- Without documented data‑classification, access‑restriction and monitoring controls, organizations cannot produce a defensible audit trail when regulators inquire.
- Mapping the missing controls to a single VCF objective provides evidence that satisfies multiple frameworks (e.g., NIST CSF, ISO 27001) in one step.
Who Is Affected — Marketing and data‑aggregation firms that rely on third‑party consumer datasets; the 131 M individuals whose personal profiles were exposed.
Recommended Actions
- Perform a full data‑inventory and classify all personal information according to regulatory requirements.
- Enforce strict access controls and enable continuous monitoring/logging on data stores.
- Map existing controls to the Verisq Common Framework (VCF) and collect evidence for audit readiness.
- Follow breach‑notification obligations in the jurisdictions where affected individuals reside.
Technical Notes — The exposure resulted from a misconfiguration that left a cloud‑based repository publicly accessible. No known vulnerability (CVE) was exploited; the data was simply readable without authentication. Source: https://haveibeenpwned.com/api/v3/breach/Exactis