AlpineReplay Snow‑Sports App Breach Exposes 898,681 User Records, Including Weakly‑Hashed Passwords
What Happened — The AlpineReplay snow‑sports tracking app suffered a breach that exposed 898,681 user accounts. The leaked data set contains names, usernames, genders, dates of birth, physical attributes, and passwords that were stored using unsalted MD5 or bcrypt hashes.
Why It Matters for Trust & Control Assurance —
- Weak password‑hashing is a classic control gap that continuous control‑mapping programs are built to detect and remediate.
- Demonstrable evidence of strong credential‑protection controls is essential for audit readiness across frameworks such as NIST CSF and ISO 27001.
- A documented, continuously‑monitored password‑storage policy provides a defensible trail if regulators or partners request proof of due diligence.
Who Is Affected — Consumer‑facing SaaS applications in the sports‑recreation sector and their users.
Recommended Actions —
- Immediately replace unsalted MD5 hashes with a modern, salted algorithm (e.g., Argon2 or bcrypt with salts).
- Conduct a control‑mapping review of credential‑storage policies and capture evidence for audit purposes.
- Notify affected users, enforce password resets, and monitor for credential‑stuffing attempts. Source: https://haveibeenpwned.com/api/v3/breach/AlpineReplay
Technical Notes — The breach involved passwords stored as unsalted MD5 (cryptographically weak) and bcrypt (but without salts). Exposed attributes include dates of birth, genders, weights, and email addresses. Source: https://haveibeenpwned.com/api/v3/breach/AlpineReplay