Loading story…
LimeLeads, a San Francisco B2B lead-generation provider that is now defunct, exposed an internet-accessible Elasticsearch server without password protection in 2019. The server, reportedly discoverable through Shodan from at least July 2019, was secured after researcher Bob Diachenko notified the company in September, but threat actor Omnichorus allegedly obtained and offered the database for sale on an underground forum.
The exposed dataset contained roughly 49 million business-contact records, including 17.8 million unique email addresses, phone numbers, employers, job titles, and location details such as cities, states, and postcodes. The breadth of corporate identity and organizational data creates material risk of targeted spear-phishing, business-email compromise, and other social-engineering campaigns against affected individuals and companies.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
A threat actor using the name Omnichorus reportedly began selling LimeLeads data on an underground forum, advertising a database of approximately 49 million business contacts. The exposed information included contact, employer, job-title, phone, and geographic details.
LimeLeads secured its publicly accessible Elasticsearch server one day after receiving Diachenko's notification.
Security researcher Bob Diachenko identified LimeLeads' exposed Elasticsearch server and notified the company. The exposure made a large database of business-contact records accessible.
LimeLeads' internal Elasticsearch server, which lacked password protection, had been indexed by Shodan as publicly accessible since at least July 27, 2019.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered an exposed **Elasticsearch** database containing roughly **24 billion** plaintext credential records, including usernames, email addresses, passwords, and associated login URLs. The dataset was estimated at more than **8 terabytes** and appeared to aggregate data from **36 sources**, including infostealer logs, Telegram channels, prior breach collections, local database dumps, and exports from live servers. Investigators said the database was publicly accessible before being taken offline, but the owner could not be identified. The exposed records create a significant risk of **credential stuffing**, account takeover, and broader identity abuse at global scale, especially for users who do not use **multi-factor authentication**. Researchers reported that more than 30 of the sources were linked to Telegram channels and that **22.6 billion** entries were broadly labeled as “collections,” while signs of regular updates suggested the dataset was being actively curated. They also found records referencing **CVE** identifiers, GitHub links, breach news, and social media posts about incidents, indicating the operator may have been monitoring the cybersecurity landscape while maintaining the credential trove.
Jul 12, 2026
A misconfigured Elasticsearch server, believed to be operated from Russia or a Russian-speaking country, was discovered leaking over 6.19 billion records to the public internet without any authentication or password protection. The exposed server contained a massive trove of 1.12 terabytes of data, including records collected from both disclosed and undisclosed data breaches, as well as information obtained through website scraping. Among the most sensitive data found were records from Ukrainian bank Accordbank, which included users’ full names, birthdates, birthplaces, addresses, phone numbers, national ID numbers, passport numbers, and tax codes. Independent cybersecurity researcher Anurag Sen was the first to identify the exposed server and report its existence to the media. The server’s index information confirmed the scale of the exposure, with over 6.19 billion records available for anyone to access. Screenshots from the server revealed that the data was stored in JSON format and included detailed personally identifiable information (PII) from various sources. The database also contained files referencing Accordbank, which were later observed being peddled by the user "tRex_Prime" on DarkForums, indicating that the data may have already been accessed and distributed by other threat actors. The leak included not only banking and contact information but also records from other breaches and data scraped from websites, making the exposure particularly broad and damaging. The server was eventually taken offline, but it remains unclear how long the data was accessible or how many unauthorized parties may have downloaded the information. Previous incidents involving hacking groups such as ShinyHunters and Nemesis were also mentioned, as they had leaked stolen data and hacking tools from other exposed cloud storage resources in the past. The incident highlights the ongoing risks associated with misconfigured cloud infrastructure and the potential for large-scale data aggregation to amplify the impact of breaches. Security experts warn that such exposed databases are prime targets for cybercriminals seeking to exploit PII for identity theft, fraud, and further attacks. The presence of both old and new breach data, as well as scraped information, demonstrates the evolving tactics of threat actors in collecting and monetizing sensitive information. Organizations are urged to regularly audit their cloud configurations and monitor for unauthorized data exposures to prevent similar incidents. The scale and sensitivity of the leaked data underscore the urgent need for improved security practices in managing large datasets, especially those containing PII from multiple sources. The incident serves as a stark reminder of the consequences of failing to secure cloud-based data storage and the far-reaching impact such exposures can have on individuals and organizations worldwide.
Jul 12, 2026
A misconfigured MongoDB database containing approximately 16 terabytes of data was discovered exposed online, revealing 4.3 billion professional records. The database, found by cybersecurity researcher Bob Diachenko in collaboration with nexos.ai, included sensitive personally identifiable information (PII) such as full names, email addresses, phone numbers, job roles, employment history, education, and links to professional platforms like LinkedIn. The dataset was organized into nine collections, with at least three containing nearly two billion unique records each, and one collection alone holding over 732 million records with photographs. The database was secured two days after discovery, but it remains unknown who may have accessed the data during the exposure window. Analysis by Cybernews and other researchers indicated that the data likely originated from various sources, possibly through scraping and aggregation, and included enrichment metrics and Apollo.io IDs, though there was no evidence of a breach at Apollo.io itself. The scale and detail of the exposed information present significant risks for targeted phishing, social engineering, and identity theft. The owner of the database has not been confirmed, and the incident highlights ongoing risks associated with unsecured cloud databases and the aggregation of large-scale professional data sets.
Jun 29, 2026