It sounds like this was email addresses only, and they're very shady about how they acquired this information in the first place.

"The real question that the researchers and Troy Hunt, founder of Have I Been Pwned?, want to know is how Verifications.io got its hands on all of this information in the first place. The Estonian-based company has refused to respond to questions from different news outlets and has taken down its entire website as of March 4, 2019. " [1]

and

"Verifications.io ensures third-parties’ email marketing campaigns are being sent out to verified accounts, and not just fake emails. " [1]

[1]: https://www.idtheftcenter.org/763-million-records-exposed-in...