Factual Data Aggregator Exposes 2.46M Email and Business Records in 2017 Breach
What Happened — A dataset containing 2,461,696 unique email addresses, employer names, phone numbers and physical addresses was posted online in March 2017. The data originated from Factual, a data‑aggregation SaaS that supplies point‑of‑interest information via APIs. Factual later clarified the information was already publicly available on its platform, but the mass release still represents a breach of user‑level records.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of relying on third‑party data providers without continuous oversight; a control‑assurance program should require ongoing monitoring of vendor data‑handling practices.
- Highlights the need for robust data‑classification and exposure‑detection controls that can surface large‑scale public disclosures as potential incidents.
- Aligns with the control objective of third‑party risk management—evidence of due‑diligence and audit‑ready documentation can satisfy multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected – SaaS data‑aggregation platforms, their enterprise customers, and any individuals whose contact information was listed.
Recommended Actions –
- Review and tighten third‑party risk contracts, ensuring clear data‑use and exposure‑notification clauses.
- Implement continuous monitoring of vendor data feeds and public‑exposure alerts.
- Classify and inventory all external data sources to support audit‑ready evidence of control effectiveness.
Source: Have I Been Pwned – Factual breach
Technical Notes – The exposure stemmed from a publicly accessible data dump rather than a technical exploit; no CVE or malware was involved. The compromised records include email addresses, employer names, phone numbers and physical addresses.