Android Forums Breach Exposes 745,355 User Accounts, Including Password Hashes
What Happened – In October 2011 the Android Forums website was compromised. Attackers extracted 745 k user records and posted them publicly. The leak contained email addresses, dates of birth, homepage URLs, instant‑messenger IDs, IP addresses and passwords stored as salted MD5 hashes.
Why It Matters for Trust & Control Assurance
- This incident illustrates the risk of weak credential storage and inadequate access‑control monitoring – a core control objective for any continuous assurance program.
- Demonstrates the need for defensible evidence that password hashing meets modern cryptographic standards and that privileged access to user data is continuously logged.
- Highlights how a single lapse can break multiple compliance mappings (e.g., NIST CSF 2.0 Protect function) across frameworks.
Who Is Affected – Online community platforms, media‑focused SaaS providers, and any organization that stores user‑generated credentials.
Recommended Actions
- Review and upgrade password‑hashing algorithms to a memory‑hard function (e.g., Argon2, bcrypt).
- Implement continuous monitoring of privileged access to credential stores and retain immutable logs for audit.
- Conduct a credential‑exposure risk assessment and update incident‑response playbooks accordingly. Source: https://haveibeenpwned.com/api/v3/breach/AndroidForums
Technical Notes – The breach was discovered via public dump; the exact intrusion method was not disclosed. Passwords were protected only with a salted MD5 hash, which is considered cryptographically weak. No specific CVE is associated. Source: https://haveibeenpwned.com/api/v3/breach/AndroidForums