AbuseWith.Us Data Breach Exposes 1.37 M Email Addresses, Passwords, and IPs
What Happened — In 2016 the website AbuseWith.us, which marketed tools for hijacking email and gaming accounts, suffered multiple data breaches. The incidents released 1,372,550 records containing email addresses, usernames, IP addresses and both plain‑text and hashed passwords.
Why It Matters for Trust & Control Assurance
- Credential theft is the exact scenario a continuous identity‑and‑access‑control program is built to detect, document, and remediate.
- Demonstrating timely password rotation, MFA enforcement, and evidence of credential‑exposure monitoring satisfies audit‑ready control objectives.
- The breach underscores the need for defensible evidence that password policies are enforced and that compromised credentials are tracked across the enterprise.
Who Is Affected — Individuals whose accounts were listed; any organization whose employees used the exposed credentials (across all sectors).
Recommended Actions
- Force password resets for any accounts matching the exposed usernames or email addresses.
- Enforce multi‑factor authentication (MFA) wherever possible.
- Deploy continuous credential‑exposure monitoring to surface reused passwords in real time.
- Document the response steps as evidence for audit readiness.
Technical Notes — The breach exposed email addresses, usernames, IP addresses and passwords (both clear‑text and hashed). No malware or ransomware was reported. Source: [Have I Been Pwned API]