How Hackers Actually Get Your Contact Lists

Your contacts rarely get stolen through some cinematic device hack. They get swept up when an attacker logs into a system legitimately — with a password that shouldn't have worked.

According to the Identity Theft Resource Center's 2024 report, stolen credentials drove four of the five mega-breaches last year, including Ticketmaster, AT&T, and Change Healthcare. ITRC CEO Eva Velasquez noted these breaches could have been blocked outright with multi-factor authentication or passkeys. Instead, they helped push victim notices to over 1.35 billion — a 211% jump from 2023.

Third-party vendor relationships widen the blast radius. Secureframe's analysis of 2024 breaches shows how the AT&T attack exploited credentials from data engineers to reach customer records stored on Snowflake, exposing roughly 73 million customer names, phone numbers, and addresses. Supply chain attacks directly hit 134 organizations and indirectly touched 657 more, generating 203 million victim notices.

Detection gaps make it worse. The Ticketmaster breach went undetected for nearly seven weeks, giving attackers time to exfiltrate 1.3 terabytes of data affecting more than 40 million users. And brute-force attacks still work: the Dell breach involved nearly 50 million login attempts over three weeks before anyone stopped it.

The common entry points look like this:

• Stolen or reused passwords — 21% of consumers reuse passwords across work and personal accounts, per Security Magazine's consumer trust research
• Third-party vendors with weaker security than the companies they serve
• Phishing and spear-phishing emails targeting employee inboxes
• Brute-force login attempts that go unnoticed without monitoring

Small businesses absorb a disproportionate share of this. Nearly 50% of cyberattacks target them, and security experts note spear-phishing is especially effective against companies with fewer than 250 employees. The human layer — passwords on Post-it notes, computers left logged in — remains the weakest link.

For any business that holds a customer list, this reframes the stakes. A contact database is an asset precisely because it's trusted, verified, and permissioned — which is exactly why protecting it matters. At CallMyCustomers, we work only from lists of real customers with outreach built on explicit consent, because a list is only worth what protects it.

Why Small Service Businesses Are Prime Targets

Small service businesses face disproportionate cyber risk due to limited security resources, making them prime targets for contact data theft. Nearly 50% of all cyberattacks target small businesses specifically because they often lack dedicated IT staff and advanced security infrastructure compared to larger organizations. This vulnerability is compounded by common employee behaviors that create easy entry points for attackers seeking customer contact lists.

Human factors remain a critical weakness in small business security postures. Employees frequently reuse passwords across work and personal accounts—a habit practiced by 21% of consumers that significantly increases exposure when one account is compromised. Additionally, 57% of consumers regularly use work devices for personal shopping, blurring security boundaries and increasing the likelihood of malware infections that could harvest stored contact information. These practices are especially risky in service businesses where staff may use personal devices for scheduling or client communication.

Weak access controls further amplify risk, particularly the absence of multi-factor authentication on business systems. Stolen credentials served as the leading attack vector in four of five 2024 mega-breaches affecting hundreds of millions of records, and experts confirm these incidents could have been prevented with MFA or passkeys. Service businesses often rely on simple password protection for customer databases, booking systems, or email accounts—precisely where contact lists are stored and most vulnerable to credential theft.