DemandScience confirms leaked 122 million record database came from its systems

DemandScience, a business to business demand generation and lead intelligence company formerly known as Pure Incubation, confirmed in November 2024 that a large database circulating on criminal forums had originated from its own infrastructure.

A user of the BreachForums marketplace operating as KryptonZambie had offered the data for sale in February 2024, advertising roughly 132.8 million records tied to Pure Incubation and asking about $6,000. The dataset was later released without charge. Analysis by Have I Been Pwned found about 122 million unique email addresses in it, alongside full names, physical addresses, telephone numbers, employer names, job titles and functions, and links to social media profiles.

Much of the material had been assembled from publicly accessible sources. Troy Hunt of Have I Been Pwned noted that although the underlying information was largely public in nature, many people were unaware it had been aggregated and distributed at this scale, and roughly 47 percent of the addresses had already appeared in earlier breaches.

DemandScience had initially denied being breached, saying its systems were fully operational and that it had found no indication of a hack. After the data was loaded into Have I Been Pwned in November 2024 and a notified individual pressed the company, DemandScience acknowledged the records had come from a system decommissioned about two years earlier, said none of its current operational systems had been exploited, and suggested a partner or contractor may have been the point of compromise. People whose details appeared in the set reported increases in spam and phishing.