Reply from Hunter.ioAug 4, 2025
Hi Jake,
We’re genuinely sorry to read your review and would like to clarify several important points, as there are multiple inaccuracies.
Security and Account Integrity
Security is a top priority for us. Our platform undergoes two external security audits each year, including penetration tests through HackerOne, and we’ve never had a reported vulnerability. We also offer enterprise-grade features like audit logs, proactive alerts, and multi-user team workspaces at no extra cost.
We do require verification when creating an account. The process includes a two-step check: first, an activation email is sent to the inbox used for sign-up. Additionally, our system may require further verification (via SMS or LinkedIn sign-up) if we need to confirm the identity more thoroughly.
In your case, after a thorough investigation with our Engineering team, it’s clear that this wasn’t a platform security failure, but rather a case of intentional and prolonged account sharing. Here’s a breakdown we have already shared with you when you contacted our support:
• The account in question (tied to John Valmonte) was created on April 2, 2020, and showed signs of multi-user access from the start. Even if the inbox associated with the account was active, the security alerts were always ignored.
• Within hours, our logs recorded multiple IPs from different locations in the Philippines, and since then, the account registered over 770 IP address changes — a clear sign of shared access.
• All account actions, including upgrades and usage of thousands of credits, came from users logged in with valid credentials.
This is a direct violation of our Terms of Service, which explicitly prohibit account sharing. It’s also a key reason why we offer unlimited seats in our team workspaces, to avoid scenarios like this.
Notification and Email Alerts
Between March 1 and May 6, we sent over 100 alerts to the registered email, including:
• IP change notifications
• Bulk activity alerts
• Billing confirmations and plan upgrade receipts
These were successfully delivered with no bouncebacks (the email linked to the account was still active), and we received no password resets, access requests, or security reports during this period. If the inbox had been decommissioned on your end, we were not informed, and no alternative contact was provided.
Unfortunately, we can’t prevent account misuse if users don’t report suspicious activity or update contact info over a multi-year period.
On the Account Owner and Access
The account is currently accessed by you, but it was originally registered under John Valmonte, who, according to you, left the company five years ago. Despite this, no ownership transfer, access removal, or billing changes were requested until recently.
Our recommendation has always been to have the company credit card holder register the main account and invite teammates as needed. This approach prevents any single user — especially one who has left the company — from having access to billing or admin privileges.
Refund and Usage
All credits were used, and all plan upgrades were initiated from within the logged-in account. Since no platform breach occurred and all services were consumed, we could not issue a refund.
This is not a case of unauthorized access by a third party, but rather continued use of a shared account without security hygiene — and without any reporting from your side for years.
We understand your frustration and we’re always open to feedback. But we also need to stand by the facts:
• No security breach occurred.
• All activity came from users with valid login access.
• Alerts were sent, they didn't bounce, but not acted on.
• We offer secure team environments, which were not used here.
We wish you all the best with your new provider, and should you wish to properly set up a secure, team-managed account in the future, we’d be happy to guide you through the process.
Best,
Giovanni
Head of Customer Success, Hunter.io
