Verifications.io — 763 Million Email Records Left on an Open Database (2019)

What happened

In February 2019, researchers Bob Diachenko and Vinny Troia found a MongoDB instance belonging to the email validation service Verifications.io sitting on the public internet with no password protecting it. It held 763,117,241 unique email addresses — the largest single entry in the Have I Been Pwned catalogue. The company's website went offline during the disclosure process.

There was no hack, no ransomware group and no extortion note. The database was simply reachable by anyone who went looking, which is how both researchers found it. That distinction matters for what you should do about it, and we come back to it below.

What an email-validation firm was doing with your address

This is the part that surprises people, and it is the reason this page exists rather than a one-line entry in a list. You were almost certainly never a Verifications.io customer. Email validation is a business-to-business service: a company with a marketing list pays a firm like this one to check which addresses on it are real and deliverable before sending to them. Your address was in the database because somebody else uploaded it.

Many records carried far more than an address. The catalogue lists names, phone numbers, physical addresses, dates of birth, genders, employers, job titles, geographic locations and IP addresses. That is a marketing profile, assembled without your involvement, from sources you cannot enumerate.