Who collected 4 billion records on 1.2 billion users?

Over a week ago, security researchers Vinny Troia and Bob Diachenko uncovered four billion records on 1.2 billion people on an unsecured Elastisearch server. The over 4TB data set comes from the data aggregator and enrichment companies People Data Labs (PDL) and OxyData.Io and contains basic personal information such as name, phone numbers, email, and information scraped from LinkedIn, Facebook, and other social sources.

While the source of the data can be traced to the two firms, it is not known how the data came to reside on the unsecure servers.

The unusual case has left victims in a vulnerable position. Victims have not been notified because nobody knows who was operating the server in question. The danger to consumers is the information can be used in phishing attacks, social engineering, and identity theft.

Without knowing who the owner of the data was, it is hard to understand the data flow. Was the data combined by a customer of both firms? Was the data exported by malicious insiders or external hackers?

A key takeaway is data should be protected at all times. Persistent protection should secure data at rest, in transit, and in use.

Transparent persistent protection is the core of the SecureCircle Data Access Security Broker. Data remains persistently protected without impacting applications, workflow, or end-user experience.