IMDataCenter data leak: were your name and home address in the open files?

In August 2025, a security researcher found an IMDataCenter database on the internet with no password and no encryption. It held 10,820 records totaling 38 GB, mostly spreadsheets. The files he sampled included names, home addresses, emails, phone numbers, and lifestyle or ownership details. They looked like client marketing “reports” and “results” — lead lists used for things such as insurance, solar, and elections.

IMDataCenter replied that data security mattered to them, thanked him for the heads-up, and said they were working to secure the information as soon as possible. Access was restricted soon after that. It is still unknown how long the database sat open, whether anyone else copied it, or whether IMDataCenter, a contractor, or an affiliate was the one running it. The company has not issued its own public notice or regulator filing about this. Later articles dated August 2026 were reprints of the 2025 finding, not a second leak.

You did not have to be their customer

Most coverage treats this as a “data center” mishap involving 10,820 personal records. That framing makes it sound like an internal list from a company you would remember doing business with, and like a small, contained number. Both impressions miss what this actually is for an ordinary person.

IMDataCenter’s work is assembling marketing files about people. You do not open an account. Your name can appear because a client wanted leads for insurance, solar panels, or an election. The open files were those reports and results — dossiers built to reach you, not a list of people who chose this company.

The 10,820 figure is also the wrong thing to stare at. That is how many records were in the database, totaling 38 GB. They were mostly spreadsheets, some with thousands to hundreds of thousands of rows. Headlines shrink that into what sounds like a small office leak. We do not have a public headcount of how many people were in those sheets, and no honest article can invent one.

What sat next to the contact details matters more than the branding. Lifestyle and ownership notes beside a home address are what make a cold call or a letter feel personal: they already know where you live and what they think you might buy. That is the real shift in meaning. This discovery did not show Social Security numbers in the sampled files. We also do not know whether anyone besides the researcher copied the database before it was locked. The honest read is not “your identity is stolen.” It is that marketing lists with names, addresses, and how to reach you were left unlocked, and if a copy was taken, it cannot be pulled back.

What to actually expect

• You should not expect a letter from IMDataCenter about this open database, and you should not expect a website or scan that can tell you whether you were in these files.
• Sales or political outreach that already uses your real name and address — especially around insurance, solar, or elections — may continue. That was the point of these files, and that market existed before this report. It is not proof you were in this database.
• If someone contacts you claiming they have “your IMDataCenter file” and can delete it for a fee, treat that as a shakedown. The original files cannot be recalled.
• The database was locked after the researcher reported it in 2025. That stops new strangers from browsing it. It does not undo any copy made while it was open. There is no public evidence so far that this specific set of files has been abused in the wild.

What you can and cannot fix

What cannot be undone is simple: if your name, home address, email, phone number, or lifestyle and ownership details were in those files, they are out. That copy cannot be recalled. Anyone who saved the open database still has it. No service can delete it from their hands, and we cannot check whether you were in this incident.

• Cut the extra public trail first. A bare leaked line — name, address, phone — becomes much more useful when it is joined to people-search listings that add relatives, more phone numbers, employers, and previous addresses. Those listings, unlike the leaked files, can actually be removed. Opting out of the major people-search sites is the lever that still works.
• Treat unexpected insurance, solar, or political pitches that already know your address as untrusted. Do not confirm extra details, one-time codes, or account passwords for anyone who cites this leak or claims to be “helping” you with it.
• Do not pay anyone to “remove you from the breach.” They cannot. Spend that effort on people-search opt-outs and on ignoring pressure tactics that use your real name and street.