Acne.org Breach Exposes 432,943 User Accounts Including Passwords and Birth Dates
What Happened – In November 2014 the consumer‑focused skin‑care site acne.org suffered a data breach that compromised more than 430 k forum member accounts. The exposed data set included email addresses, dates of birth, usernames, IP addresses and clear‑text passwords. The compromised credentials have been observed circulating on underground forums.
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to protect authentication secrets – a core control objective for identity and access management.
- Continuous control‑assurance programs require demonstrable evidence that credential storage, hashing, and access monitoring are effective, preventing the kind of credential leakage seen here.
- Mapping this breach to the ACCESS_CONTROLS capability shows how a robust, auditable IAM framework can supply the defensible evidence needed for NIST CSF 2.0 governance.
Who Is Affected – Consumer‑focused web platforms, online forums, and any organization that stores user credentials without strong protection mechanisms.
Recommended Actions
- Verify that passwords are stored using industry‑standard salted hashing (e.g., Argon2, bcrypt).
- Implement continuous monitoring of authentication logs for anomalous access patterns.
- Conduct a credential‑risk assessment and update incident‑response playbooks to include credential‑reset procedures.
- Document all remediation steps as evidence for audit readiness.
Technical Notes – The breach appears to have resulted from inadequate password storage and possibly insufficient access controls; no specific CVE is associated. Exposed data types: email addresses, dates of birth, IP addresses, usernames, and clear‑text passwords. Source: Have I Been Pwned – Acne.org breach