The PDL Data Breach – How secure is your data?

What data was leaked in the PDL breach?

The PDL Data breach shared data records included usernames, social media accounts, 622 million email addresses and 50 million unique phone numbers. Whilst the data set did not contain passwords or social security numbers, it does have all the information necessary to impersonate someone.

“This is the first time I’ve seen all these social media profiles collected and merged with user profile information into a single database on this scale. From the perspective of an attacker, if the goal is to impersonate people or hijack their accounts, you have names, phone numbers, and associated account URLs. That’s a lot of information in one place to get you started.” Stated Vinnie Troia in a recent Wired article

Data sets like this one are often used for criminal activity including: phishing, scamming and identity theft. However, the intention of the data leak remains unclear, because this data was fully accessible with no payment required and with no links to an author and PDL has since claimed that the data was not obtained as a result of a breach but instead was likely resold or released by one of their customers.