2019 LimeLeads — unsecured Elasticsearch; 17.8M unique emails (HIBP Sep 2026)
Data compromised
Per HIBP: 17.8M unique email addresses plus phone numbers, employers, job titles, and geographic locations (state, city, postcode). Largely corporate B2B contact data.
Technical writeup
Verified Have I Been Pwned load — added September 22, 2026 for an August 2019 incident. Now-defunct B2B marketing leads service LimeLeads left an Elasticsearch server unsecured; tens of millions of corporate contact records exposed, with 17,838,396 unique email addresses indexed by HIBP alongside phones, employers, job titles, and geo fields. Contemporary reporting (ZDNet) described ~49M records sold after researcher discovery. companyConfirmed true via HIBP attestation of the historical corpus; recordsAffected 17838396.
Root cause
Exposed unsecured Elasticsearch server (HIBP / historical trade reporting)