The call arrives on the cell number you never published. The caller knows your employer, your job title, and the street you live on. She has your LinkedIn profile open while she talks. She says she is confirming a few details for an investor database, and she needs one more thing from you. A row in the Crunchbase data breach is where a call like that comes from, and the file holds 559,908 email addresses.
Confirmation: confirmed by Crunchbase, which said a threat actor “exfiltrated certain documents from our corporate network” (Security Affairs, January 26, 2026). Have I Been Pwned counted the contents of the published file and loaded the breach on October 14, 2026.
What happened in the Crunchbase data breach
Crunchbase sells intelligence about private companies. Investors, recruiters and sales teams use it to look up who runs what, who funded it, and how to reach them. So the product is a directory of people, and most of those people are not customers.
In January 2026 the extortion group ShinyHunters targeted the company in what researchers call a “pay or leak” attempt. Crunchbase declined to pay. The group then published a 402 MB compressed archive of what it said it had taken, according to Security Affairs.
The company confirmed the exfiltration and said it had contained the incident. It also said no business operations were disrupted. Researchers have linked the wider campaign to voice phishing aimed at single sign-on credentials at technology firms, though Crunchbase has not described how the attackers got in.
Then the file sat in public for nine months. On October 14, 2026, Have I Been Pwned loaded it and began notifying people. For most of the 559,908, that notification is the first they have heard of any of this.
What the Crunchbase data breach exposed
Have I Been Pwned lists the fields it found in the published archive. They are email addresses, names, phone numbers, physical addresses, employers, job titles and social media profiles.
No passwords appear on that list. No payment card numbers either. That sounds like good news, and it is worth looking at what each remaining field actually does.
- Phone number and physical address. These are the two details that make a cold call sound
- Employer and job title. Together they tell an attacker who you report to and what you can
- Social media profile. It supplies your photo, your history and your colleagues’ names.
- Email address. This is the delivery route for everything above.
legitimate, because a stranger should not have them.
authorize.
So the file is not a credential dump. It is a targeting package, and it is already public.
Two Million Records, or 560,000? The Crunchbase Data Breach Count Is Disputed
ShinyHunters claimed more than 2 million personal records (Security Affairs). Have I Been Pwned counted 559,908 unique email addresses in the archive it processed (Have I Been Pwned).
Both figures can be true at once, because a record is not a person and one person can appear in several rows. The hackers’ number counts rows and comes from the hackers. The smaller number counts distinct addresses and comes from an independent analysis of the file itself. So treat 559,908 as the figure to rely on.
Crunchbase has not published a notification count of its own.
Why a profile you did not create is the harder problem
A breached password is annoying, but you can replace it this afternoon. Your phone number, your home address and the name of your employer are not things you rotate.
And most of the people in the Crunchbase data breach have no account to secure. Have I Been Pwned describes the addresses as largely belonging to leads and business contacts. In plain terms, many of these are people a sales database collected rather than people who signed up. There is no password for them to change, no settings page to visit, and no login to delete.
So what follows a leak like this is contact. Expect a message that reads your own details back to you, because that is the cheapest way to sound real.
What to do now
Most of what helps here has nothing to do with us.
- Treat a readback as worthless. Someone who recites your title and your address has proved
- Verify by calling back on a number you looked up yourself. Do not use the number in the
- Put a password manager on every account that still has a password, so one leaked login
- Turn on the strongest sign-in each account offers, which usually means a passkey or an
- Watch for a message dressed as Crunchbase. A breached brand is the easiest costume for the
- See what else carries your address at
they hold the file, not that they are who they say.
message.
cannot open a second door.
authenticator app rather than text message codes.
follow-up phish.
Have I Been Pwned, which is free.
How OptMsg changes this exposure
Let us be precise about this, because the breach happened at another company and nothing on our side could have stopped it. What OptMsg changes is what reaches you afterward.
Two mechanisms matter here. First, your OptMsg account has no password, so a password someone steals from another site cannot open your inbox. Second, mail from a sender you have not approved goes to Trash, not your Inbox, and auto-deletes after 30 days. The follow-up phish that impersonates Crunchbase lands there, next to the rest of it.
That is the whole claim, and here is where it stops. But it does not help if someone compromises your device, if you type your details into a live phishing page, or if someone has your unlocked phone. It does nothing about the call to your cell number, because a phone is not an inbox. Our Private Always page explains the approach in full.
So the part worth keeping is narrower than it sounds and more useful than it looks. Your inbox is the reset route into nearly everything else you own. Keep that door shut, and the rest stay shut with it. You can create an OptMsg account in a few minutes.
Create Your Account
Your Inbox. Your Rules.
Frequently asked questions
Q: Was my password exposed in the Crunchbase data breach? A: No. The published archive contains email addresses, names, phone numbers, physical addresses, employers, job titles and social media profiles. Have I Been Pwned lists no passwords and no payment card data.
Q: How many people were affected? A: The figure is disputed. ShinyHunters claimed more than 2 million records. Have I Been Pwned counted 559,908 unique email addresses in the file, which is the more reliable number because it counts people rather than rows.
Q: I never had a Crunchbase account. Why is my data in it? A: Crunchbase is a business intelligence platform, so it holds profiles of people who never registered. Have I Been Pwned describes the exposed addresses as largely belonging to leads and business contacts.
Q: The breach was in January. Why am I hearing about it now? A: The archive was published in January, but Have I Been Pwned only processed and loaded it on October 14, 2026. The notification emails went out that day.
Q: What is the realistic risk? A: Targeted contact. Someone holding your title, employer, phone number and address can write a convincing email or make a convincing call, so verify any request independently before you act on it.
Sources
- Have I Been Pwned — Crunchbase, loaded October 14, 2026
- Security Affairs — ShinyHunters claims 2 million Crunchbase records; company confirms breach, January 26, 2026
- UpGuard — Crunchbase breach reports, January 24, 2026
Previous in Breach Breakdown: The iRhythm Data Breach Handed Strangers Your Heart Monitor's Paper Trail
Next in Breach Breakdown: Burger King Japan Will Email 11 Million People About a Breach of Their Email Addresses
