KnownCircle Breach Exposes Nearly 2 Million Real‑Estate & Insurance Accounts
What Happened — In April 2016 an external party obtained a large JSON dump from KnownCircle, a marketing‑automation platform serving real‑estate and insurance agents. The leak contained email addresses, names, genders, phone numbers, physical addresses, email message logs, and bcrypt‑hashed staff passwords for 1,957,600 accounts.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient third‑party oversight; a continuous vendor‑risk program would have required evidence of data‑handling controls before onboarding.
- Highlights the need for auditable proof that vendors protect credentials (e.g., strong hashing, rotation, and access monitoring).
- Shows why organizations must maintain a defensible audit trail of due‑diligence activities to satisfy control‑assurance requirements.
Who Is Affected – Real‑estate brokerages, insurance agencies, and any business that relied on KnownCircle’s marketing automation services.
Recommended Actions –
- Review and update your third‑party risk management policy to include periodic security assessments of marketing‑automation vendors.
- Collect and retain evidence of vendor security controls (encryption, credential storage, breach‑notification clauses) for audit readiness.
- Verify that any retained credentials from former vendors are rotated or revoked.
Technical Notes – The breach involved a bulk data exfiltration of JSON files; no specific vulnerability (CVE) was disclosed. Passwords were stored as bcrypt hashes, but the presence of staff credentials indicates inadequate credential‑access segregation. Source: Have I Been Pwned – KnownCircle breach