In 2019, security researchers Vinny Troia and Bob Diachenko found a Verifications.io MongoDB database publicly accessible without authentication. The email-validation company processed marketing lists, and the exposed database reportedly contained 809 million records, including 763 million unique entries. Its contents included email addresses, phone numbers, names, dates of birth, genders, physical addresses, ZIP codes, IP addresses, and other marketing data. The disclosure was widely reported as one of the largest exposures of U.S. personally identifiable information, although that characterization is a media comparison rather than a formal regulatory finding.
Diachenko notified the company, which said it was taking “appropriate measures.” Verifications.io’s website was taken down by March 4, 2019, and MediaPost reported on March 15 that the firm had ceased operations. DynaRisk separately linked the company to three additional MongoDB exposures, which it said brought the combined total above 2 billion records and included potentially more sensitive information such as credit scores, mortgage amounts, and interest rates; those additional claims were attributed to DynaRisk rather than independently established in the supplied source. Researchers and security firms, including Troy Hunt and McAfee, warned that the exposed data could enable phishing and social-engineering attacks.
