Unsecured Elasticsearch Server Exposes 17.8 M B2B Contact Records from LimeLeads
What Happened
In 2019 the B2B marketing leads platform LimeLeads suffered a breach when an Elasticsearch database was left exposed without authentication. The misconfiguration allowed public access to 17,838,396 records containing corporate email addresses, phone numbers, employer names, job titles, and geographic locations.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous configuration‑management controls that detect and remediate insecure data stores before they become exploitable.
- Highlights the importance of maintaining auditable evidence of vendor security posture, especially for third‑party data‑processing services.
- Reinforces that a robust control‑assurance program must include regular verification of encryption, access controls, and monitoring logs for all external data repositories.
Who Is Affected
- Marketing and sales organizations that purchased or relied on LimeLeads contact data.
- Any business that stored or shared the exposed records, including recruiters, SaaS vendors, and B2B service providers.
- Individuals whose professional contact information was listed in the dataset.
Recommended Actions
- Review any contracts or data‑sharing agreements with LimeLeads and assess exposure risk.
- Validate that continuous monitoring controls (e.g., asset inventory, configuration scanning) are in place for all third‑party services.
- Request a detailed incident‑response disclosure from the vendor, including remediation steps taken.
- Conduct a data‑subject impact assessment and, where required, notify affected individuals per applicable regulations.
- Update internal policies to require proof of secure configuration for any outsourced data stores.
Technical Notes
- Attack vector: Unauthenticated access to an exposed Elasticsearch server.
- CVE(s): None reported specific to this incident; the vulnerability stemmed from misconfiguration rather than a software flaw.
- Data types exposed: Email addresses, phone numbers, employer names, job titles, city/state/postal code.
Source: https://haveibeenpwned.com/api/v3/breach/LimeLeads