33M Corporate Profiles Exposed in NetProspex Data Breach
What Happened — In 2016, more than 33 million records sourced from Dun & Bradstreet’s NetProspex marketing database were leaked online. The dataset included names, email addresses, job titles, employer names, phone numbers and physical addresses. D&B says the data was lost by a downstream customer who had purchased the list.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient third‑party oversight when vendors handle large volumes of personal and corporate data.
- Highlights the need for continuous monitoring of vendor security practices and contractual safeguards to produce defensible audit evidence.
- Aligns with the control objective of “vendor risk management” that maps to many frameworks (e.g., NIST CSF 2.0) and can be validated through Verisq’s Vendor‑Risk Management capability.
Who Is Affected – Marketing data providers, B2B SaaS platforms, and any organization that purchases or shares corporate contact lists (primarily corporate America).
Recommended Actions
- Review contracts with data‑suppliers for explicit security and breach‑notification clauses.
- Implement continuous third‑party risk monitoring to verify that vendors maintain appropriate controls.
- Collect and retain evidence of due‑diligence activities for audit readiness.
Technical Notes – The breach appears to be a loss of data by a customer rather than a technical exploit; no CVE or malware is associated. Exposed data types: email, name, job title, employer, phone, address. Source: [Have I Been Pwned – NetProspex breach]