Crunchbase Breach: 559,908 Emails & Contact Data Exposed

Overview

Crunchbase, the private company intelligence platform used by investors, sales teams, and journalists, has confirmed that a threat actor exfiltrated documents from its corporate network. The breach, carried out in January 2026, exposed 559,908 unique email addresses along with a broad set of personal and professional details. The incident has been reported to Have I Been Pwned, meaning affected individuals can now verify whether their information was caught up in the leak.

The attack followed a “pay or leak” extortion model, in which the attacker threatened to publish stolen data unless a payment was made. Crunchbase did not pay, and the data was subsequently released publicly. The company later acknowledged that documents had been taken from its corporate network.

What Was Exposed

The leaked dataset goes well beyond email addresses. Affected records include:

• Email addresses - 559,908 unique addresses, largely belonging to leads and business contacts rather than just registered users
• Names - both personal and professional
• Phone numbers - direct lines and possibly mobile numbers
• Physical addresses - street-level location data
• Employers - the organizations contacts are affiliated with
• Job titles - role and seniority information
• LinkedIn profiles - links to professional profiles

Because Crunchbase is built on business-contact data, much of this information was likely compiled from sales pipelines, marketing lists, and partnership inquiries rather than self-registered accounts.

How the Breach Happened

The attacker used a “pay or leak” extortion strategy: steal data, demand payment, and publish it if the victim refuses. Crunchbase confirmed that a threat actor exfiltrated documents from its corporate network, but has not disclosed the specific intrusion vector. The ShinyHunters campaign behind the attempt has targeted multiple SaaS and data-aggregation companies in recent years.

Why Business Contact Data Matters

At first glance, names and job titles seem low-risk. They are not. This combination of email, phone, employer, job title, and physical address is a goldmine for targeted phishing and social engineering. An attacker can craft a message that references a victim’s real employer and role, making a fraudulent request far more convincing. Phone numbers enable SMS phishing (smishing) and voice-call scams, while physical addresses raise risks of impersonation and mail fraud. Business contacts are also frequently targeted with invoice fraud and executive-impersonation attacks.

What to Do Right Now

• Check if you’re affected at haveibeenpwned.com/Breach/Crunchbase.
• Treat unexpected messages with suspicion. If someone references your employer, title, or a real business relationship, verify through a separate, trusted channel before acting.
• Watch for smishing and vishing. Do not click links or share codes from unexpected texts or calls, even if the caller knows your details.
• Use a password manager and enable two-factor authentication on your email and financial accounts.
• Consider a secondary email for marketing and lead forms, keeping your primary address out of aggregated datasets.
• Report suspicious activity to your IT or security team, especially if you handle payments or credentials at work.

Security Insight

This breach shows that aggregation platforms accumulate risk in proportion to the data they collect, and Crunchbase’s exposure was compounded because much of the leaked information came from sales leads and business contacts who never signed up for the service and therefore had no way to know their data was stored there. The refusal to pay is the right call, but it also means the leaked records are now permanently available to attackers, and unlike a password leak, contact data cannot be reset or rotated. Companies that build products on third-party contact data should treat that data with the same care as customer credentials, because a leak of names, emails, and employers is enough to fuel convincing, personalized attacks for years.

Further Reading

• All High Breaches
• Recent Data Breaches