View source for Company:Verifications.io

{{Short description|Email marketing company, defunct 2019}}
{{Infobox company
| name = Verifications.io
| logo = Verifications.io logo.png
| type = [[Finance:Privately held company|Private]]
| industry = Email marketing
| defunct = {{End date|2019|03|25}}
| fate = [[Data breach]]
| hq_location = Tallinn, Estonia (listed) <br/>Boca Raton, Florida (alleged)
| area_served = Worldwide
}}

'''Verifications.io''' is a defunct email-focused technology firm whose primary practice was to validate email addresses for email marketing platforms. The company's platform allowed for email marketing firms to submit lists to the company, which would verify the lists for valid email addresses.

Verifications.io shut down in 2019 due to a major data breach, which was reported by some sources to be among the largest in recorded history. The total records within the company's largest single data release was 809 million records, 763 million of which were unique, though the total number of records which were exposed in three additional database leaks from the company would total to over 2 billion records breached.<ref>{{Cite web |date=2019-03-11 |title=Verifications.io breach: Database with 2 billion records leaked |url=https://www.hackread.com/verifications-io-breach-database-with-2-billion-records-leaked/ |access-date=2023-09-07 |language=en-US}}</ref>

== Operations and company history ==
Verifications.io offered its clients services which could verify if emails were bounced, or were otherwise inactive, thereby helping email marketers send emails to actual users rather than random email addresses. The firm achieves its verifications by internal servers, which are matched with client records uploaded to the service for their verification. The firm verifies each email by sending a message to each address; if the message does not bounce, the firm considers it verified. Bounced emails are stored on a list which the firm can refer to in the event the same email is presented again.<ref name=":0">{{Cite web |last=Diachenko |first=Bob |date=2019-03-07 |title=800+ Million Emails Leaked Online by Email Verification Service |url=https://securitydiscovery.com/800-million-emails-leaked-online-by-email-verification-service/ |access-date=2023-09-07 |website=securitydiscovery.com |language=en}}</ref>

Verifications.io officially claims to be an Estonian company based out of [[Place:Tallinn|Tallinn]], though many press filings released from and about the company suggested that it was based out of Boca Raton, Florida.<ref name=":1">{{Cite web |date=March 11, 2019 |first=Mathew J. |last=Schwartz |title=Breach of 'Verifications.io' Exposes 763 Million Records |url=https://www.bankinfosecurity.com/breach-verificationsio-exposes-763-million-records-a-12158 |access-date=2023-09-07 |website=www.bankinfosecurity.com |language=en}}</ref>

== 2019 data breach ==
The first Verifications.io data breach ultimately led to 763 million unique records being exposed to the web, with 809 million if counting duplicated records.<ref>{{Cite news |last=Hay Newman |first=Lily |title=An Email Marketing Company Left 809 Million Records Exposed Online |language=en-US |work=Wired |url=https://www.wired.com/story/email-marketing-company-809-million-records-exposed-online/ |access-date=2023-09-07 |issn=1059-1028}}</ref> The breakdown of the records was 798,171,891 email records; 4,150,600 phone records, and 6,217,358 business lead records. Each record also had the possibility of including a zip code, a physical address, an IP address, a name, a birthday, and the gender of the user.<ref name=":0" /> The poor security of the information was credited to a [[Software:MongoDB|MongoDB]] file which was not password protected, allowing anybody to access the information with the correct link.<ref name=":0" />

Troy Hunt, the founder of [[Have I Been Pwned?]], has predicted that approximately 35 percent of all records is new to the Have I Been Pwned? database; as of the leak, the Verifications.io breach is the second largest breach added to Have I Been Pwned? after Hunt's own [[Collection No. 1]].<ref name=":2">{{Cite web |last=McAfee |date=2019-03-08 |title=809 Million Records Left Exposed: How Users Can Protect Their Data |url=https://www.mcafee.com/blogs/privacy-identity-protection/809-million-records-exposed/ |access-date=2023-09-07 |website=McAfee Blog |language=en-US}}</ref><ref>{{Cite news |last=Newman |first=Lily Hay |title=An Email Marketing Company Left 809 Million Records Exposed Online |language=en-US |work=Wired |url=https://www.wired.com/story/email-marketing-company-809-million-records-exposed-online/ |access-date=2023-09-07 |issn=1059-1028}}</ref> Many cybersecurity companies showed immediate concern that the data released in the breach could be used for social engineering attacks. Daniel Markuson, the blog editor for the online privacy firm [[Software:NordVPN|NordVPN]], raised concerns that 1 in 9 people in the world could be the targets of a social engineering campaign.<ref>{{Cite web |last=Markuson |first=Daniel |date=2019-03-08 |title=What you need to know: 1 out of 9 people just got breached |url=https://nordvpn.com/blog/verifications-io-breach-800-million/ |access-date=2023-09-07 |website=nordvpn.com |language=en}}</ref> [[Company:McAfee|McAfee]] additionally highlighted the databases' possibility to foster social engineering attacks against those whose information was exposed in the database.<ref name=":2" />

According to UpGuard, the first data breach alone ranks as the third largest data breach in history from a single company, falling short only to the [[Biology:Aadhaar|Aadhaar]] data breach and the [[Yahoo! data breaches|Yahoo data breach]].<ref>{{Cite book |last=Ghosh |first=Dipayan |url=https://www.jstor.org/stable/10.7864/j.ctvbnm3mc |title=Terms of Disservice: How Silicon Valley Is Destructive by Design |date=2020 |publisher=Brookings Institution Press |isbn=978-0-8157-3765-0 |doi=10.7864/j.ctvbnm3mc.7}}</ref>

The UK security firm DynaRisk however stated that Verifications.io was also linked to three other MongoDB data breaches. All four data breaches combined would total the number of records exposed to over 2 billion. DynaRisk further stated that the three other data breaches contained much more sensitive information, such as interest rates, mortgage amounts, [[Software:Instagram|Instagram]] and [[Company:LinkedIn|LinkedIn]] profiles linked to leaked emails, and [[Finance:Credit score|credit scores]].<ref>{{Cite web |date=2019-03-11 |title=Verifications.io breach: Database with 2 billion records leaked |url=https://www.hackread.com/verifications-io-breach-database-with-2-billion-records-leaked/ |access-date=2023-09-07 |language=en-US}}</ref><ref>{{Cite web |last=Winder |first=Davey |title=(Updated) 2 Billion Unencrypted Records Leaked In Marketing Data Breach --What To Do Next |url=https://www.forbes.com/sites/daveywinder/2019/03/10/2-billion-unencrypted-records-leaked-in-marketing-data-breach-what-happened-and-what-to-do-next/ |access-date=2023-09-07 |website=Forbes |language=en}}</ref> Cybersecurity professional Bob Diachenko stated that while not every single record contained all the mentioned types of information, a large number of them were "very detailed".<ref>{{Cite web |last=Huskerson |first=Tom |date=2019-04-10 |title=Breach Brief - Verifications.IO Exposes 2B Records! |url=https://ontechstreet.com/2019/04/breach-brief-verifications-io-exposes-2b-records/ |access-date=2023-09-07 |website=On Tech Street |language=en-US}}</ref>

=== Response from the company ===
Diachenko emailed the company about the data breach, which responded by stating it was taking "appropriate measures" to correct the breach. By March 4, 2019, the website for the company was taken down.<ref name=":1" /> By March 15, MediaPost reported that Verifications.io was out of business.<ref>{{Cite web |title=Email Vendor Verifications.io Seems To Be Out Of Business Following Breach |url=https://www.mediapost.com/publications/article/333276/email-vendor-verificationsio-seems-to-be-out-of-b.html |access-date=2023-09-07 |website=www.mediapost.com |language=en}}</ref>

== References ==
{{Reflist}}

== External links ==
[https://web.archive.org/web/20190227230352/https://verifications.io/ Official website], archived on February 17, 2019, from [https://verifications.io the original]
[[Category:Data breaches]]
[[Category:Email authentication]]
[[Category:Companies (Computing)]]
[[Category:Companies]]

{{Sourceattribution|Verifications.io}}