Dun & Bradstreet dnb.com Dun & Bradstreet data breach: what happened and what to do
Dun & Bradstreet said it was one of several victims of a criminal cyberattack that mainly took place over 15 days in March and April 2013. It reported to California on October 28, 2013. The exposed data was largely public business information. No count was published.
View all 13,177 breaches- Breach date
- 2 Apr 2013
- Made public
- 28 Oct 2013
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Dun & Bradstreet (D&B), the New Jersey business information company, told customers in 2013 that it had been one of several victims of a criminal cyberattack. Its notification letter said the attack mainly took place over a 15-day period in March and April 2013. D&B's notice was reported to the California Attorney General on October 28, 2013, and the breach date on that list is April 2, 2013.
What was exposed
D&B said the potentially exposed information is generally available from public sources. In some cases it may have included personal information that people provided in a business context, such as contact details tied to a company. The sources don't give a number of affected people.
What it means for you
Business contact details are enough to power convincing phishing. A message that names your employer, your job title and a real business relationship looks legitimate, so treat unexpected requests for payments, logins or invoices with suspicion, especially anything that mentions D&B.
What D&B did
D&B notified people and said it had learned of the attack. News coverage tied the disclosure to a report by journalist Brian Krebs about a criminal service whose botnet had reached D&B systems.
Sources checked: databreaches.net, oag.ca.gov
Last verified against the official page:
What to do if you were in it
- 1
Treat business emails with care
Be wary of unexpected invoices, payment changes and login requests, even when they name your company. Check with the sender through a number or address you already trust.
- 2
Change reused passwords and turn on two-factor login
If you reuse a password from a business account, change it everywhere and turn on two-factor login with an authenticator app or passkey.
- 3
Report phishing
Forward phishing emails to reportphishing@apwg.org and report them at reportfraud.ftc.gov, as the FTC advises.
- 4
Check whether your details are in other breaches
Run a free Serus scan to see whether your email or phone number shows up in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your data appears; it can't remove data from a breach.
Official filings
- California Attorney General , filed 28 Oct 2013
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Dun & Bradstreet breach?
D&B said the exposed data was generally public business information. If you got a notification letter, you were included.
What was exposed?
D&B said the information was generally available from public sources, and in some cases may have included personal information given in a business context.
Should I change my password?
D&B didn't say passwords were exposed. If you reuse a password across business accounts, change it anyway and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
