Threat Intelligence

Crunchbase Data Breach: 560K Business Contacts From January Now Searchable

In short

In January 2026, the ShinyHunters extortion group published more than 400 MB of files taken from Crunchbase after the company refused to pay.
This is not a new breach, but it is newly searchable: Have I Been Pwned loaded the data on October 14, 2026, with 559,908 unique email addresses.
Most of the records are business leads and contacts: names, job titles, employers, phone numbers, physical addresses and LinkedIn profiles. No passwords are listed.
Your staff can be in this data without ever having used Crunchbase, which makes them easier targets for convincing phishing and phone scams.

Crunchbase, the platform that tracks private companies, investors and executives, confirmed a breach on January 26, 2026. The ShinyHunters group had posted more than 400 MB of compressed files on its leak site after Crunchbase refused to pay a ransom, and claimed the files held more than 2 million records with personal information. Crunchbase told SecurityWeek: “Crunchbase detected a cybersecurity incident where a threat actor exfiltrated certain documents from our corporate network.” The company said the incident was contained, its business was not disrupted, and it had brought in outside experts and contacted federal law enforcement. It also said it was reviewing the data to decide whether it had to notify anyone.

Nine months later, on October 14, 2026, Have I Been Pwned (HIBP) loaded the published data: 559,908 unique email addresses, mostly belonging to leads and business contacts, along with names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. That is far fewer than the 2 million records the group claimed. What changed this week is not the breach, it is that anyone can now check whether an address is in it.

Crunchbase has not said how the attackers got in. ShinyHunters claims to be behind a voice phishing campaign against Okta single sign-on accounts and lists Crunchbase among its victims; that link has not been confirmed. It fits the group’s usual method, which we cover in our article on ShinyHunters’ 2026 pay-or-leak campaign.

What the exposed data enables

Name, job title, employer, direct phone and LinkedIn profile is exactly what someone needs to sound like a real contact. An email about “the agreement we discussed” or a call from a “partner” who knows your title and office address is much easier to believe. Expect this data to feed targeted phishing, fake invoices and phone calls that impersonate vendors, investors or recruiters.

Does this touch your business?

Possibly, even if nobody on your team ever signed up. Crunchbase collects information about companies and the people who run them, and HIBP describes most of this data as leads and business contacts. If your company or its leaders appear on Crunchbase, check the work addresses of the people most likely to be listed: owners, executives, sales and finance.

No passwords are listed, so the risk is not a direct login to your systems. The risk is that a scammer now has accurate details to win your team’s trust.

What to do this week

Check the addresses that matter. Run work addresses through our free Am I Breached? checker and turn on alerts. The Crunchbase breach page lists every field that was exposed.
Warn the people most likely to be listed. Tell owners, executives, sales and finance that a caller or sender who knows their name, title and company is not automatically legitimate.
Confirm money and access requests on a second channel. Any request to change bank details, send a payment, reset a password or approve a login gets confirmed by calling a number you already have, not one in the message.

Frequently asked questions

Is the Crunchbase breach new?

No. It happened in January 2026 and Crunchbase confirmed it on January 26. What is new is that Have I Been Pwned loaded the data on October 14, 2026, so it can now be searched.

How many people are affected?

Have I Been Pwned counted 559,908 unique email addresses. ShinyHunters claimed more than 2 million records, and Crunchbase has not published a number.

Were passwords exposed?

No passwords are listed. The data includes email addresses, names, physical addresses, phone numbers, job titles, employers and social media profiles.

How do I know if my email is in the Crunchbase data?

Enter it in our free Am I Breached? checker, which uses Have I Been Pwned data, and turn on alerts.

Data from Have I Been Pwned | Sources: SecurityWeek | Written with AI assistance and checked against these sources on October 17, 2026

Found this useful? The next one can come to you.

We write now and then: practical security for a small business, the month's ransomware figures in plain language, and new free tools when they land. No spam, and one click to leave.

A tool by Digital Checkmark