Searchbug, a US people-search and contact-data verification service, says it is recovering from a ransomware attack that "disrupted our services and exposed customer information." If your business uses Searchbug's website or its API for phone, address or identity lookups, there are a few things to do this week, and none of them can wait for the company to finish its investigation.
What Searchbug has confirmed
In a security incident and service restoration notice on its support site (last updated November 3, 2026), Searchbug says:
- A ransomware attack disrupted its services and exposed customer information. The company says it is "investigating the incident and assessing its impact."
- Its engineers have moved systems to new servers and added security measures. Restoration is still ongoing.
- Account access is available again. Customers should use Password Recovery to reset their passwords, and Searchbug recommends turning on multifactor authentication (MFA).
- API users need to reset their password, log in, generate a new API key and update their integrations right away. Generating a new key automatically turns off the old one.
- The attackers have threatened to contact customers directly.
Searchbug hasn't said what customer information was exposed, how many customers are affected, when the attack began or who was behind it. We haven't found independent reporting yet, so for now the company's notice is the only source. We'll update this post if that changes.
Why this matters to small businesses
On its company profile, Searchbug says its customers include businesses in lead generation, insurance, fintech, collections, real estate and contact centers. Those are often small shops where one person set up the account years ago. The API key may be sitting in a CRM plugin, a spreadsheet macro, a dialer or a developer's test tool, and nobody remembers which. That's the real risk here. The password reset is quick. The problem is the forgotten copy of the old credential and the phishing that follows a breach.
What to do now
- Reset the Searchbug password. Type
searchbug.cominto the browser yourself, and don't click a link in an email to get there. If anyone reused that password anywhere else, change it there too. - Turn on MFA for every user on the account, and remove logins for people who no longer need them.
- Rotate the API key, then go hunting. Generate the new key, then check your CRM, dialer, lead forms, scripts, automation tools and any Postman or cached settings, which Searchbug specifically mentions. Since the old key stops working, anything that breaks is a place you missed. Write each location down so the next rotation takes minutes, not a day.
- Brief your staff on extortion phishing. Searchbug warns that the attackers may reach out to customers. Tell your team that any unexpected email, text or call about the incident, especially one asking for passwords, API keys, verification codes or payment, gets reported, not answered. If they're unsure, they should call Searchbug's published support line at 800-990-2939.
- Check your own obligations. If you sent client or customer records through Searchbug lookups, talk to your compliance lead, insurance carrier or attorney about whether you need to document this or tell anyone. Do it before you know the scope, not after.
The takeaway for IT decision-makers
Every data vendor you plug into is part of your attack surface. Keep a simple list of the services that hold an API key or a shared login, with the owner, where the key lives and how to rotate it. When a vendor's notice lands, you can work down that list instead of searching for keys under pressure. If you'd like help building that list or rotating keys across your systems, Brotherly Technology can help.
Sources
- Searchbug: Security Incident and Service Restoration Notice (last updated Nov 3, 2026; checked Nov 5, 2026)
- Searchbug, Inc. on LinkedIn (company description of customer industries)