A breach at a company you never used

Everything added to the public record this week came out of a sales database. That distinction does more work than any of the totals below, because it decides who found out. A breached customer list produces an email to customers. A breached lead database produces nothing, since the people in it were never on a list of customers to write to.

Who is in it

Crunchbase is the private-company intelligence platform — the site people use to look up who funded whom. A British reader is plausibly in this one, but not as a user of it. What was published is Crunchbase's own leads and business contacts: names, phone numbers, home addresses, employers, job titles and social media profiles. If you work in UK technology, venture capital or enterprise sales, and your details ever reached Crunchbase's internal contact records through a trial, a sales call or a conference list, that is the route in rather than anything you signed.

Sharecare is an American digital health company, the one behind AskMD. Its exposed records are overwhelmingly the same kind of material: business-to-business sales and marketing contacts, the names and addresses and job titles of people who sell to or buy from the US health industry. A British reader is unlikely to be among them. The exception is smaller and sharper — a subset of Brazilian health insurance plan members, carrying dates of birth, gender, marital status and CPF numbers, Brazil's taxpayer identity number. Those people are actual members. Theirs is the one group in this week's record that did sign up for something.

Everything added this week

Below is what the record gained in the seven days to 16 October. Where a figure is shown it counts account records rather than people: one person appearing in a company's database under two addresses appears twice. Treat it as the size of the pile, not the size of the crowd.

• Crunchbasecrunchbase.com · 560,000 accounts · added 2026-10-14

  Exposed email addresses, employers, job titles, names and phone numbers.

• Sharecaresharecare.com · 318,000 accounts · added 2026-10-12

  Exposed dates of birth, email addresses, employers, genders and ID document numbers.

What was in it

No entry in this window lists a password. The advice that normally follows a breach therefore applies to none of it. What these carry is the layer underneath a password — the layer that has no reset.

• Home addresses and phone numbers appear in every entry here, and so do employers and job titles. A sales database is built to record exactly that set: who you are, where to reach you, who you work for and what you have the authority to buy. It is also, almost exactly, the set a people-search listing is assembled from, and none of those fields expire.
• Crunchbase's records add social media profiles, which in this dataset means LinkedIn. A LinkedIn profile next to a home address and a direct phone number identifies one specific person beyond argument. That is a materially different exposure from a leaked email address, which identifies an inbox.
• The Brazilian plan members in Sharecare's data are the only people in this window whose records carry a date of birth and a government identity number. Have I Been Pwned's field list calls those government-issued IDs; in the published data they are CPF numbers.

Why you are in a file you never opened

A lead database exists to hold people who have not agreed to anything yet — that is its entire function. Your details arrive in one because you downloaded a report, attended a webinar, appeared on a bought list, or were researched by somebody paid to research you. Nothing in that process looks to you like handing over data, and nothing at the end of it leaves you with an account to log into, a password to change, or a relationship the company recognises when it has to tell people what it lost.

The route in is worth noting too, because it was not a technical flaw. The group that claimed the entries here says it reached Crunchbase through a vishing campaign against Okta single sign-on: phone calls to staff, aimed at the login rather than the firewall. Crunchbase confirmed in late January that a threat actor had exfiltrated documents from its corporate network, said no business operations were disrupted, and said it had contacted federal law enforcement. Sharecare has not commented publicly; its records were listed in August and published since.

What to do about the ones that cannot be reset

• Nothing here calls for a password change. No entry in this window lists one, and changing a password does not remove a home address from anywhere.
• Treat an unexpected call that already knows your employer, your job title and where you live as unverified by default. That combination is precisely what a sales database holds, and it is what makes the call sound as though it came from inside. Hang up and dial the organisation back on a number you looked up yourself. The attack that started this one was a phone call to somebody's colleague.
• If your details sit in a lead database, they very likely also sit with the people-search firms that buy and resell lead databases. That is the part of this with an actual route out, and it is the slow part: nothing prompts you to begin it.
• The ICO takes complaints about how an organisation handled your personal information, and being a lead rather than a customer does not change that. It will not award you compensation — that is a matter for the company or a court.

Every holder we act against is published by name, so the claim is checkable rather than a promise. The coverage list marks which of them carries a home address.