iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
On December 13, 2016, CSO Online reported that a seller was advertising a 6 GB dataset said to contain records for 203,419,083 people. The seller claimed the information came from Experian, but Experian denied a compromise, and the report did not establish the dataset’s true source. These were claims about a dataset offered for sale—not a confirmed Experian breach or an independently audited count.
What was advertised in 2016?
Steve Ragan’s December 13, 2016 report for CSO Online described an offer for a set of files totaling 6 GB. The seller reportedly listed 203,419,083 people and asked $600. Those figures came from the seller’s offer as reported at the time; they were not an independently audited record count or confirmation that a sale was completed.
The report described the material as data-enrichment records: profiles combining identifying details with additional attributes. It cited more than 80 enrichment fields, but that does not mean every profile contained every field.
What information did the records reportedly contain?
Alongside names, full addresses, dates of birth, and phone numbers, the report described fields that could give a detailed picture of a person’s finances, household, and interests.
#1 Best Overall
- Financial and economic details: credit ratings, active credit lines, credit-card use, investments, net worth, and household income.
- Household and demographic details: home ownership, residence type, marital status, children in the household, occupation, and education.
- Personal interests and activity: political and charitable donations, international travel, casino indicators, and purchasing preferences. Examples in the report included home gardening and recent auto-parts purchases.
These are attributes described in the report and its sample, not proof that each record had all of them or that every field was accurate.
Was this a confirmed Experian data breach?
No. The seller attributed the dataset to Experian, but the report did not verify that attribution. Experian told Salted Hash that it had investigated and found no signs of compromise, calling the allegation unsubstantiated and suggesting it could be intended to increase the data’s sale value. Acxiom did not respond to the outlet’s inquiry. The dataset’s actual source remained unconfirmed.
CSO reported that Peerlyst’s technical review board vetted submitted material and that a sample went to the Salted Hash team for additional verification. Calls to people listed in the sample reached voicemail and were not returned. Those steps did not comprehensively authenticate every record or prove where the dataset originated.
What risks did the report raise?
J. Tate, identified in the report as CISO of bits&digits, warned that combining contact details with granular personal and marketing information could make targeted phishing more convincing and could support identity fraud or attempts to answer knowledge-based authentication questions. These were risks raised at the time, not documented crimes shown to have resulted from this dataset.
The report does not establish whether the dataset was later authenticated, removed, resold, or traced to a source. It is historical reporting from 2016, not evidence of a current incident.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
