ADDA Housing Societies Service Breach Exposes 1.8 M Accounts
What Happened – In March 2025 a data set from the ADDA housing‑societies platform was posted on a public hacking forum. The dump contained 1,829,314 unique email addresses, names, phone numbers and MD5 password hashes.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential storage and the need for strong hashing, salting, and periodic credential rotation.
- Highlights the importance of continuous monitoring of access‑control policies and evidence of due‑diligence for audit readiness.
- Provides a concrete example of why a defensible audit trail of identity‑management controls is essential for regulatory and contractual trust.
Who Is Affected – Property‑management SaaS providers, real‑estate associations, and any organization that stores resident or member credentials.
Recommended Actions
- Verify that password hashes use a modern, salted algorithm (e.g., bcrypt, Argon2) and retire MD5 hashes.
- Conduct a credential‑access review: enforce MFA, rotate compromised passwords, and monitor for anomalous log‑ins.
- Document the incident response steps and update your control‑assurance evidence for access‑control objectives.
Technical Notes – The breach appears to be a credential‑compromise incident; the exact attack vector was not disclosed. Exposed data includes email addresses, full names, phone numbers and MD5 password hashes, which are vulnerable to offline cracking. Source: Have I Been Pwned – ADDA breach