Breach Year
2019
Breach Type
Data Broker / Marketing Vendor
TPRM Lesson
Marketing vendors quietly accumulate billions of records.
What was the Verifications.io Email Validation Exposure breach?
The Verifications.io exposure was a February 2019 incident in which a MongoDB database belonging to the email validation vendor Verifications.io was found publicly accessible, exposing 763 million records including email addresses, phone numbers, dates of birth, employer information and, in some cases, mortgage and social media details.
Verifications.io is the case that showed marketing vendors quietly accumulate billions of records.
Companies had used the service to clean their marketing lists. The vendor kept the aggregated result.
A single misconfigured database exposed one of the largest email datasets in history.
Verifications.io was an email verification service used by marketers to filter valid addresses from their outreach lists.
25 Feb 2019. Researcher Bob Diachenko discovered an open 150 GB MongoDB database.
Contents. 763 million records with email, phone, DOB, employer and other data.
Post-disclosure. Verifications.io took the database offline and briefly went dark.
The exposure drove standardised security clauses for marketing data processors under GDPR and equivalent frameworks.
No attack was needed. The vendor exposed itself. TPRM failed at the moment of vendor selection.
A. Identity and Access. No unauthenticated database exposure.
B. SaaS and API Integrations. Discover shadow marketing tools.
C. Software Supply Chain. Assess data-broker sub-processors.
D. File Transfer and Data Exchange. Encrypt list uploads.
E. Data Protection. Delete data at engagement end.
F. Vendor Incident Response. Hours-based notification.
G. Fourth-Party Risk. Map data-broker relationships.
H. Board and Executive Reporting. Marketing-data risk quarterly.
"When a vendor aggregates every customer's list, the breach is everyone's."
An email validation service used by marketers.
763 million.
By researcher Bob Diachenko in February 2019.
Downstream companies' marketing data was aggregated at the vendor.
Email, phone, DOB, employer and other personal details.
Authentication on the database and retention limits.
Marketing vendors are data controllers in effect, even if not on paper.
No, the service went dark shortly after disclosure.
All claims in this case study are grounded in verified public reporting.
TPRM Blog
Continue learning with the latest breach alerts, regulatory updates, and analyst playbooks from blog.learntprm.com.
Founding SponsorAlmost every case here was findable before it happened
Read enough third-party breaches and the pattern is brutal: an undisclosed fourth party, an expired certification, an exposure that sat on the internet for weeks. Nobody was lazy - the signals simply arrive faster than a human review cycle. The SAFE TPRM AI Co-Worker watches for them continuously.
This is for you if you own a third-party risk program - roughly 100+ vendors, quarterly reassessments, DORA / NIS2 / OCC pressure and no new headcount coming. The link opens Safe Security's platform page, not a gated form.
Five correlated data dimensions per vendor, refreshed continuously across the whole portfolio.
For security and risk leaders assessing a TPRM platform. Opens safe.security in a new tab.
25+
AI agents
90%
Less manual effort
None
Additional headcount
200+
Organizations globally
End to end
Intake to offboarding
Most people talk about risk management. Few can prove their expertise under pressure.
Start Your Free Certification