When most people think of a data breach, they picture stolen passwords. But one of the largest entries in the LeakedSource index contains none. Verifications.io, leaked on 25 February 2019, accounts for 722,745,807 records, making it the third-largest breach among the 38,125 distinct breaches we track. Its contents are a reminder that a breach doesn't need credentials to cause harm.
Where Verifications.io Sits in the Breach Landscape
Our database now indexes 31,140,458,535 breach records. Verifications.io alone represents roughly 2.3% of that total, from a single incident.
It ranks behind only two other entries:
- XSS.IS Combolist: 2,472,611,041 records
- Misc Combolists: 1,927,529,995 records
Verifications.io is about 11% larger than Collection #1 (649,890,560 records), which surfaced just over a month earlier, on 23 January 2019. It was also leaked only three days before the XSS.IS Combolist. Four of the ten largest breaches in our index are dated 2019, including Weibo and Collection #1, which makes early 2019 one of the heaviest periods in our records.
What Makes This Breach Different
Look at the data types for the top ten breaches and a pattern emerges. Most are combolists or credential dumps:
- XSS.IS Combolist: email, username, plaintext password
- Misc Combolists, Ga$$Pacc Collection, AntiPublic, and Pemiblanc: email and plaintext password
- Exploit.in and MySpace: email plus passwords or hashes
Verifications.io is the outlier. Its exposed fields are:
- Email Address
- Phone Number
- First Name
- Last Name
There are no passwords and no hashes. Of the ten largest breaches, it is the only one listing both first and last names alongside contact details. Weibo, at 503,294,488 records, is the only other top-ten entry exposing phone numbers, but its data type is phone number alone.
This profile matters because of how rarely these fields appear together. Across our database, First Name appears in 1,533 breaches and Last Name in 1,512. Phone Number appears in just 1,104, about 2.9% of all tracked breaches. Plaintext passwords, by contrast, turn up in a staggering 33,820 breach entries by our count. Identity-rich records like those in Verifications.io are comparatively scarce, and that scarcity makes them valuable.
Why Password-Free Data Is Still Dangerous
It's tempting to downplay a breach with no passwords. You can't log into someone's bank account with a name and a phone number. But that isn't how modern attacks work.
A record with a full name, an email address, and a phone number gives an attacker everything needed to build a convincing pretext:
- Targeted phishing: An email addressed to you by your real first and last name is far more persuasive than a generic "Dear customer" message.
- SMS and voice scams: A phone number tied to a name enables smishing and vishing that sound personal and urgent.
- Credential stuffing prep: Attackers can pair your email address with passwords from other breaches. Our index holds 1,822 breaches with plaintext passwords, and a verified email is a ready-made key to try against them.
- Account recovery abuse: Names and phone numbers are often the exact details used to answer support questions or intercept recovery codes.
In short, a breach like Verifications.io supplies the who, and combolists supply the how. When the two overlap, risk compounds.
The Bigger Picture: Breaches You Never Signed Up For
Another aspect deserves attention. The name suggests Verifications.io was a business-to-business service, and that is the uncomfortable part. Many people in a dataset like this never had a direct relationship with the company. Their details reached it through third parties, which means you can be exposed without ever creating an account or agreeing to anything.
Our breach-type data shows how common that is. Of the breaches we track, 17,604 are stealer logs and 14,196 are combolists, while only 4,602 are classic databases. The rise of aggregated and secondary data sources means your information may sit in many places you've never heard of.
What You Can Do
You can't un-leak 722 million records, but you can limit the damage.
- Treat unexpected, personalized messages with suspicion. A message that uses your real name and phone number isn't proof of legitimacy. Verify through an official app or website you navigate to yourself, not through links in the message.
- Use unique passwords and a password manager. Because email addresses from breaches like this are paired with leaked credentials elsewhere, reusing a password is the fastest way to turn a low-severity exposure into an account takeover.
- Enable multi-factor authentication, ideally app- or hardware-based. Where possible, avoid relying on SMS alone. Since phone numbers are exposed in breaches like this one, they are an easier target than an authenticator app.
Check Your Own Exposure
Verifications.io shows that the most damaging breach isn't always the one with passwords in it. If your email address or phone number appears in a dataset this size, you could be on the receiving end of targeted attacks without knowing why.
Search your email address and see which breaches include you with LeakedSource. Knowing where your data has been exposed is the first step toward closing the doors attackers would use next.