AgusiQ‑Torrents.pl Breach Exposes 90K User Accounts with MD5‑Hashed Passwords
What Happened — In September 2019 the Polish torrent site AgusiQ‑Torrents.pl suffered a data breach that released 90,478 user records. The exposed data includes email addresses, IP addresses, usernames and passwords stored as unsalted MD5 hashes.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential storage — a control‑assurance program should require strong hashing (e.g., salted bcrypt) and regular review of credential‑handling policies.
- Highlights the need for continuous monitoring of access to user databases and evidence that only authorized processes can read or export credential data.
- Aligns with the Identity & Access Management control objective, which underpins many frameworks (e.g., NIST CSF 2.0) and is the focus of Verisq’s ACCESS_CONTROLS capability.
Who Is Affected – Online media platforms, file‑sharing services, and any organization that stores user credentials without robust hashing.
Recommended Actions
- Inventory all credential stores and verify that passwords are hashed with a modern, salted algorithm.
- Implement privileged‑access monitoring and log all read/export operations on credential databases.
- Conduct a gap analysis against the “credential protection” control objective and collect evidence for audit readiness. Source: https://haveibeenpwned.com/api/v3/breach/AgusiQTorrents
Technical Notes – The breach disclosed MD5‑hashed passwords, a known weak hash vulnerable to pre‑image attacks. No specific CVE is associated; the exposure stems from inadequate storage practices. Source: https://haveibeenpwned.com/api/v3/breach/AgusiQTorrents