Marketing and email data platform Netcore Cloud leaks over 40 billion email marketing records
Learn More
Cybersecurity researcher Jeremiah Fowler discovered an unencrypted publicly available database containing approximately 40 billion (with a B) records totaling 13.41 TB.
The database belongs to Netcore Cloud Pvt. Ltd, a Mumbai-based marketing automation platform that provides outbound marketing services to approximately 6,500 brands across 40 countries.
The exposed database contained mail log records including bank notifications, employment-related messages, account verification emails, and marketing messages. Within the limited sampling conducted, Fowler found healthcare notifications and banking activity notices, some containing partial account numbers, IP addresses, and SMTP details. Numerous records were marked as confidential. The database also appeared to contain information about internal services and access data marked as "production," referencing databases and backend update servers.
Exposed data includes:
- Email addresses (both personal and professional)
- Mail delivery records and log files
- Bank notification details with credits and debts information
- Partial account numbers
- IP addresses and SMTP details
- Message subjects and content
- Healthcare notifications
- Employment-related messages
- Account verification information
- Server names and infrastructure details
- Internal service access data
The exact number of affected individuals has not been disclosed. The number of affected individuals is likely in the millions, given that Netcore Cloud serves 6,500 brands across sectors including ecommerce, retail, banking and financial services, media and entertainment, and travel.
Fowler immediately sent a responsible disclosure notice to Netcore Cloud, and the database was restricted from public access the same day. It's not clear how long the database was exposed prior to discovery or whether unauthorized parties accessed it.
