In June 2018, cybersecurity researcher Vinny Troia discovered that Exactis LLC, a Florida data broker founded in 2015, had left nearly 340 million records on a publicly accessible server. The exposed database reportedly contained about 230 million consumer records and 110 million business records—more than the 145 million customers affected by the 2017 Equifax breach. Exactis obtained information through public-data scraping and purchases from other brokers to support targeted advertising.
The records included names and other personal information such as home addresses, email addresses, and telephone numbers, although the source says they did not contain passwords or credit-card data. Troia notified Exactis, which restricted access to the server. Exactis functionally closed after the disclosure, while a subsequent class-action lawsuit stalled because the company had limited resources and it remained unclear whether anyone besides Troia accessed the data. The incident illustrated the privacy risks created by lightly regulated data brokers and unsecured databases, even without evidence of confirmed criminal exploitation.
