500px Breach Exposes 14.9 M User Records Including Password Hashes
What Happened – In mid‑2018 the photography community platform 500px suffered a data breach that released 14,867,999 user records. The dump contained email addresses, names, usernames, genders, dates of birth and password hashes (MD5 or bcrypt). The data resurfaced on a dark‑web marketplace in 2019 and has since been widely shared.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential protection and weak access‑control safeguards – a core control area that continuous‑monitoring programs must evidence.
- Highlights the need for defensible audit trails around password storage, hashing standards, and privileged‑access reviews.
- Aligns with the Access Controls capability in Verisq’s suite, which helps organizations collect and present evidence of strong identity‑management practices.
Who Is Affected – Online platforms serving creative professionals (media & entertainment), SaaS photo‑sharing services, and any organization storing user‑generated content.
Recommended Actions
- Verify that password hashing follows current best‑practice algorithms (e.g., Argon2, bcrypt with appropriate cost).
- Conduct a credential‑access review to ensure least‑privilege principles and MFA enforcement for privileged accounts.
- Capture evidence of these controls in a continuous‑control‑assurance system to support audit readiness. Source: https://haveibeenpwned.com/api/v3/breach/500px
Technical Notes
- Attack vector not publicly disclosed; breach likely stemmed from a credential‑storage weakness or compromised admin access.
- Exposed data types: DOB, email, gender, location, name, password hash, username. Source: https://haveibeenpwned.com/api/v3/breach/500px