Your Business Identity Extends Beyond Your Network

A total of 18 breach events were found and analysed resulting in 33,195,209 exposed accounts containing a total of 51 different data types of personal datum. The breaches found publicly and freely available included ULP Alien Txt File - Episode 39, ZenBusiness, Charter Communications, Stealer Log 0562 and Outlook Business Contact. Sign in to view the full library of breach events which includes, where available, reference articles relating to each breach.

The signal this week

The 18 breach events analysed this week contained more than 33 million exposed accounts and 51 distinct types of personal data. The selected examples point to a risk that is easy to underestimate: a business identity exists across far more than an organisation’s own network.

Business formation services, telecommunications providers, contact books, saved credentials and authenticated browser sessions can all form part of the identity layer surrounding an organisation. Each serves a different purpose, but together they connect people, businesses, devices and services.

This does not mean every event contained the same information or created the same level of risk. It does show why identity protection cannot begin and end with a corporate email address and password.

What the selected breaches tell us

The selected breaches represent several parts of the business identity layer:
- ULP Alien Txt File – Episode 39 is a credential-oriented collection containing URL, login and password records, rather than a breach attributed to one organisation.
- ZenBusiness provides company formation, compliance and administrative services to entrepreneurs and small businesses.
- Charter Communications provides broadband, mobile, video and voice services to residential and business customers.
- Stealer Log 0562 is a collection originating from information-stealing malware.
- Outlook Business Contact is a business-contact collection containing information used to identify and communicate with people and organisations.

The BreachAware team has recorded and reviewed the provenance of this material. The limited descriptions shared here are intentional: they provide defenders with relevant context without publishing source locations, detailed contents or information that could encourage misuse.

Together, the examples touch four important business functions: establishing an organisation, connecting it, communicating on its behalf and authenticating the people who operate it.

[ZenBusiness describes its platform as supporting company formation and ongoing business administration](https://help.zenbusiness.com/About_ZenBusiness/Getting_Started/How_Does_the_ZenBusiness_Service_Work%3F). [Charter Communications provides connectivity services through its Spectrum brand](https://corporate.charter.com/about-charter). [Microsoft describes Outlook contacts as records used to organise information about people and organisations](https://learn.microsoft.com/en-us/graph/api/resources/contact?view=graph-rest-1.0).

Why the surrounding identity layer matters

Security teams naturally concentrate on accounts inside their own environment. However, an employee’s business identity may also be represented in supplier portals, communications services, contact databases, personal browsers and external administrative platforms.

Contact data does not provide system access on its own, but it can reveal relationships and communication routes. Where names, roles, organisations and contact details appear together, they may help make impersonation or payment-change requests more convincing.

Credential collections introduce a different concern. A URL, login and password combination can identify both an account and the service where it is used, although its age and validity must be assessed before conclusions are drawn.

Stealer logs require additional context because information-stealing malware can capture more than passwords. Depending on the infection, the material may include browser cookies, saved sessions, autofill information and device details. This can make a password-only response incomplete.

Australia’s national cyber-security authority advises that information stealers can capture corporate credentials and authentication cookies, including cookies capable of maintaining access without a new login. [Australian Cyber Security Centre guidance](https://www.cyber.gov.au/threats/types-threats/malware/information-stealer-malware).

None of this establishes that every exposed account remains active or that every record presents an immediate threat. It does establish the need to assess the type, age and context of exposure before deciding how to respond.

Three defensive checks

1. Map the external identity layer. Identify the third-party services used to establish, administer and operate the business. Record who has access, which recovery channels are configured and what happens when an administrator leaves or changes role.
2. Treat stealer-log exposure as a possible device incident. Where the evidence supports it, investigate the affected endpoint and revoke active sessions before resetting credentials. Changing a password alone may leave other forms of access intact.
3. Strengthen requests made through trusted relationships. Help-desk, finance and supplier-management teams should independently verify unusual account-recovery, payment or contact-detail changes. A familiar name, company or email history should not be sufficient proof.

Perspective

These findings do not demonstrate that business-service or telecommunications companies are being targeted more heavily than other sectors. The selected examples are not a representative sample from which to calculate sector trends.

The account total should not automatically be interpreted as 33,195,209 unique or currently active people. The material may include duplicate, historical or overlapping records. Similarly, the 51 data types describe the variety found across all the analysed events; they were not necessarily present in every event or account.

The useful conclusion is that organisational identity extends beyond systems directly controlled by the organisation. Effective protection depends on understanding the wider network of services, contacts, devices and sessions through which people conduct business.

BreachAware does not publish source locations, complete breach inventories or unnecessary operational details that could facilitate misuse.