123RF Stock Photo Platform Exposes 8.66 M User Accounts in 2020 Data Breach
What Happened — In March 2020 the stock‑photo service 123RF suffered a data breach that resulted in the public release of 8,661,578 subscriber records. The dump contained email addresses, IP addresses, physical and mailing addresses, phone numbers, names, usernames, and passwords stored as unsalted MD5 hashes.
Why It Matters for Trust & Control Assurance
- Weak password hashing and lack of encryption illustrate a classic credential‑protection gap that continuous‑control programs are built to detect and remediate.
- Demonstrates the need for auditable evidence that strong authentication and password‑storage policies are enforced across the organization.
- Provides a concrete example of a control failure that maps to multiple frameworks (e.g., NIST CSF 2.0 Protect function) and can be addressed through a focused access‑control assurance capability.
Who Is Affected — Media‑content platforms, digital asset marketplaces, and any organization that integrates 123RF imagery into its products; the exposed users span multiple geographies and industries.
Recommended Actions
- Immediately replace MD5‑hashed passwords with a modern, salted algorithm (e.g., bcrypt, Argon2).
- Conduct a control‑mapping exercise for credential‑protection controls and collect evidence of hashing, storage, and access‑policy enforcement.
- Validate that logging and monitoring of authentication events are in place and retained for audit purposes.
- Notify affected individuals in accordance with applicable breach‑notification regulations.
Technical Notes — The breach source remains undisclosed; no specific vulnerability (CVE) was identified. The compromised data was posted on public dump sites and later indexed by Have I Been Pwned (HIBP). Source: https://haveibeenpwned.com/api/v3/breach/123RF