Adecco Data Breach Exposes 4.28 M Accounts, Including Password Hashes
What Happened — In March 2021 a breach of Adecco’s South‑America customer database was discovered and later posted on a hacking forum. Over 4.2 million records were exposed, containing email addresses, names, genders, dates of birth, marital status, phone numbers and bcrypt‑hashed passwords.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential protection and the need for continuous monitoring of password‑related assets.
- Highlights the importance of a documented access‑control program that can produce audit‑ready evidence of hashing standards, password‑policy enforcement, and breach‑response readiness.
Who Is Affected – Staffing and professional‑services firms, their clients, and any downstream partners that rely on Adecco’s identity data.
Recommended Actions – Review and harden password‑storage practices (e.g., verify use of strong, salted hashing), implement continuous credential‑leak monitoring, and map your credential‑management controls to the relevant control objective for audit evidence. Source: Have I Been Pwned – Adecco breach
Technical Notes – The breach included personal identifiers and bcrypt password hashes; the exact attack vector was not disclosed. Source: same as above