Public Business Data – 27.9 M Accounts Exposed from Bureau van Dijk’s Orbis Customer
What Happened – In August 2021 a hacker‑controlled dump of hundreds of gigabytes of business‑profile data was posted on a public hacking forum. The data originated from a customer of Bureau van Dijk’s (BvD) Orbis product and contained 27,917,714 records of names, dates of birth, email addresses, phone numbers, job titles and physical addresses. No unauthorized access to BvD’s own systems was reported.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate privacy and data‑handling controls over third‑party‑supplied information, a scenario continuous control‑assurance programs are built to detect and document.
- Highlights the need for defensible evidence of consent, data‑classification, and retention policies that can be presented during audits or regulator inquiries.
- Shows how a lapse in vendor‑oversight (the Orbis customer) can cascade into a large‑scale personal‑data exposure, underscoring the value of ongoing third‑party monitoring.
Who Is Affected – Companies that rely on BvD’s Orbis data (financial services, consulting, market‑research firms) and any individuals whose personal details were included in the exposed dataset.
Recommended Actions
- Review and tighten privacy‑control policies for any third‑party data you ingest, ensuring clear consent and lawful basis documentation.
- Capture and retain evidence of data‑handling decisions (e.g., data‑classification tags, consent records) to support audit readiness.
- Deploy continuous monitoring of third‑party data sources to detect anomalous extraction or distribution activities.
Technical Notes – The breach involved public‑source aggregation, not a vulnerability in BvD’s platform. Exposed data types: names, dates of birth, email addresses, phone numbers, job titles, physical addresses. Source: https://haveibeenpwned.com/api/v3/breach/BVD