AerServ Ad Management Platform Breach Exposes 66,308 Accounts
What Happened — In April 2018 the AerServ ad‑management platform suffered a data breach that publicly disclosed 66,308 records. Exposed data included email addresses, names, job titles, phone numbers, physical addresses and passwords stored as salted SHA‑512 hashes. The data dump was posted to Twitter later that year and InMobi, AerServ’s acquirer, confirmed awareness of the incident.
Why It Matters for Trust & Control Assurance
- Continuous third‑party risk monitoring is essential to detect and remediate gaps in a vendor’s data‑protection controls before a breach occurs.
- Maintaining auditable evidence of password‑storage policies and encryption practices supports control‑objective verification across frameworks.
- A documented vendor‑oversight program provides a defensible audit trail for regulators and partners when a supplier breach surfaces.
Who Is Affected — Advertising‑technology SaaS providers, their client advertisers, and the end‑users whose personal data was stored on AerServ.
Recommended Actions —
- Initiate a third‑party risk assessment of AerServ/InMobi, focusing on data‑handling and cryptographic controls.
- Verify that password‑hashing mechanisms meet industry‑best practices (e.g., salted, strong hash functions, iteration).
- Update incident‑response playbooks to include supplier‑breach scenarios and collect evidence for audit readiness. Source: https://haveibeenpwned.com/api/v3/breach/AerServ
Technical Notes — The breach involved exposure of email, employer, job title, name, phone, physical address, and password fields. Passwords were stored as salted SHA‑512 hashes; no specific vulnerability or CVE was disclosed. Data was posted publicly on Twitter in 2018. Source: https://haveibeenpwned.com/api/v3/breach/AerServ