AnimeLeague Breach Exposes 192,134 User Accounts, Including Password Hashes and Private Messages
What Happened — In July 2024 AnimeLeague disclosed that an attacker extracted two databases covering event registrations and a phpBB bulletin board. The dump, later posted for sale, contained 192,134 records with usernames, email addresses, dates of birth, phone numbers, purchase history, private messages, and password hashes (SHA‑1, salted MD5, bcrypt).
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential storage and weak access controls – a core control area that continuous‑monitoring programs must evidence.
- Highlights the need for defensible audit trails showing how password policies, hashing standards, and privileged‑access reviews are enforced.
- Aligns with Verisq’s Access Controls capability, which helps organizations collect, map, and present evidence of strong identity‑management practices.
Who Is Affected – Online community platforms, forums, and any SaaS that stores user‑generated content and credential data (media/entertainment, hobby sites, niche e‑commerce).
Recommended Actions
- Verify that password storage uses modern, memory‑hard hashing (e.g., Argon2) and retire legacy SHA‑1/MD5 hashes.
- Conduct a credential‑access review: limit privileged read access to user databases and enforce MFA for administrators.
- Update incident‑response playbooks to include evidence‑preservation steps for forensic logs and user‑notification timelines.
Source: Have I Been Pwned – AnimeLeague breach
Technical Notes
- Attack vector not publicly disclosed; breach appears to stem from compromised backend access or insufficient database segmentation.
- Exposed data types: email, DOB, phone, IP, usernames, private messages, purchase records, and password hashes (SHA‑1, salted MD5, bcrypt).
Source: same as above